pom.xml

<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
  <modelVersion>4.0.0</modelVersion>

  <groupId>com.cloudforgeci</groupId>
  <artifactId>cfc-core</artifactId>
  <version>3.1.0-SNAPSHOT</version>
  <packaging>pom</packaging>

  <name>CloudForge Core BOM</name>
  <description>Bill of Materials (BOM) for CloudForge infrastructure deployment libraries</description>
  <url>https://github.com/CloudForgeCI/cfc-core</url>

  <licenses>
    <license>
      <name>Apache License, Version 2.0</name>
      <url>https://www.apache.org/licenses/LICENSE-2.0.txt</url>
      <distribution>repo</distribution>
    </license>
  </licenses>

  <developers>
    <developer>
      <id>cloudforgeci</id>
      <name>CloudForge CI Team</name>
      <email>support@cloudforge.com</email>
      <organization>CloudForge CI</organization>
      <organizationUrl>https://www.cloudforgeci.com</organizationUrl>
    </developer>
  </developers>

  <properties>
    <!-- Build Properties -->
    <maven.compiler.source>21</maven.compiler.source>
    <maven.compiler.target>21</maven.compiler.target>
    <java.version>21</java.version>
    <build.version.suffix></build.version.suffix> <!-- Blank by default -->

    <!-- AWS CDK Versions -->
    <!-- Note: v2.197.0+ defaults to nodejs22.x for AwsCustomResource which isn't available in all regions -->
    <cdk.version>2.196.0</cdk.version>
    <constructs.version>10.3.0</constructs.version>
    <cdknag.version>2.37.55</cdknag.version>

    <!-- Core Library Versions -->
    <jackson.version>2.19.4</jackson.version>
    <jakarta.validation.version>3.0.2</jakarta.validation.version>

    <!-- Test Dependency Versions -->
    <jupiter.version>5.12.2</jupiter.version>
    <hibernate.validator.version>8.0.1.Final</hibernate.validator.version>
    <jakarta.el.version>4.0.2</jakarta.el.version>

    <!-- Plugin Versions -->
    <maven.compiler.plugin.version>3.13.0</maven.compiler.plugin.version>
    <maven.source.plugin.version>3.3.0</maven.source.plugin.version>
    <maven.javadoc.plugin.version>3.7.0</maven.javadoc.plugin.version>
    <maven.gpg.plugin.version>3.2.4</maven.gpg.plugin.version>
    <maven.deploy.plugin.version>3.1.1</maven.deploy.plugin.version>
    <jacoco.plugin.version>0.8.13</jacoco.plugin.version>
    <cyclonedx.plugin.version>2.8.2</cyclonedx.plugin.version>
    <owasp.plugin.version>12.1.0</owasp.plugin.version>
    <central.publishing.plugin.version>0.9.0</central.publishing.plugin.version>
    <flatten.plugin.version>1.7.3</flatten.plugin.version>
  </properties>

  <dependencyManagement>
    <dependencies>
      <!-- CloudForge Modules -->
      <dependency>
        <groupId>com.cloudforgeci</groupId>
        <artifactId>cloudforge-core</artifactId>
        <version>${project.version}</version>
      </dependency>
      <dependency>
        <groupId>com.cloudforgeci</groupId>
        <artifactId>cloudforge-api</artifactId>
        <version>${project.version}</version>
      </dependency>

      <!-- AWS CDK Dependencies -->
      <dependency>
        <groupId>software.amazon.awscdk</groupId>
        <artifactId>aws-cdk-lib</artifactId>
        <version>${cdk.version}</version>
      </dependency>
      <dependency>
        <groupId>software.constructs</groupId>
        <artifactId>constructs</artifactId>
        <version>${constructs.version}</version>
      </dependency>

      <!-- CDK Nag for compliance validation -->
      <dependency>
        <groupId>io.github.cdklabs</groupId>
        <artifactId>cdknag</artifactId>
        <version>${cdknag.version}</version>
      </dependency>

      <!-- Jackson JSON Processing -->
      <dependency>
        <groupId>com.fasterxml.jackson.core</groupId>
        <artifactId>jackson-annotations</artifactId>
        <version>${jackson.version}</version>
      </dependency>
      <dependency>
        <groupId>com.fasterxml.jackson.core</groupId>
        <artifactId>jackson-databind</artifactId>
        <version>${jackson.version}</version>
      </dependency>
      <dependency>
        <groupId>com.fasterxml.jackson.core</groupId>
        <artifactId>jackson-core</artifactId>
        <version>${jackson.version}</version>
      </dependency>
      <dependency>
        <groupId>com.fasterxml.jackson.datatype</groupId>
        <artifactId>jackson-datatype-jsr310</artifactId>
        <version>${jackson.version}</version>
      </dependency>
      <dependency>
        <groupId>com.fasterxml.jackson.dataformat</groupId>
        <artifactId>jackson-dataformat-yaml</artifactId>
        <version>${jackson.version}</version>
      </dependency>

      <!-- Jakarta Validation API -->
      <dependency>
        <groupId>jakarta.validation</groupId>
        <artifactId>jakarta.validation-api</artifactId>
        <version>${jakarta.validation.version}</version>
      </dependency>

      <!-- Test Dependencies -->
      <dependency>
        <groupId>org.junit.jupiter</groupId>
        <artifactId>junit-jupiter</artifactId>
        <version>${jupiter.version}</version>
        <scope>test</scope>
      </dependency>
      <dependency>
        <groupId>org.hibernate.validator</groupId>
        <artifactId>hibernate-validator</artifactId>
        <version>${hibernate.validator.version}</version>
        <scope>test</scope>
      </dependency>
      <dependency>
        <groupId>org.glassfish</groupId>
        <artifactId>jakarta.el</artifactId>
        <version>${jakarta.el.version}</version>
        <scope>test</scope>
      </dependency>
      <dependency>
        <groupId>jakarta.el</groupId>
        <artifactId>jakarta.el-api</artifactId>
        <version>5.0.0</version>
      </dependency>
    </dependencies>
  </dependencyManagement>

  <scm>
    <connection>scm:git:https://github.com/CloudForgeCI/cfc-core.git</connection>
    <developerConnection>scm:git:ssh://git@github.com/CloudForgeCI/cfc-core.git</developerConnection>
    <url>https://maven.pkg.github.com/CloudForgeCI/cfc-core</url>
  </scm>

  <modules>
    <module>cloudforge-core</module>
    <module>cloudforge-api</module>
    <!-- cfc-testing is intentionally excluded - it's an independent consumer module -->
    <!-- cfc-testing depends on cloudforge-core but is not part of the reactor build -->
  </modules>

  <profiles>
    <profile>
      <id>dev</id>
      <activation><activeByDefault>true</activeByDefault></activation>
      <properties>
        <build.version.suffix>-SNAPSHOT</build.version.suffix>
      </properties>



    </profile>
    <profile>
      <id>release</id>
      <properties>
        <build.version.suffix></build.version.suffix>
      </properties>
      <build>
        <pluginManagement>
          <plugins>

            <plugin>
              <groupId>org.apache.maven.plugins</groupId>
              <artifactId>maven-javadoc-plugin</artifactId>
              <version>3.7.0</version>
              <configuration>
                <doclint>none</doclint>
                <failOnError>false</failOnError>
              </configuration>
              <executions>
                <execution>
                  <id>attach-javadocs</id>
                  <goals><goal>jar</goal></goals>
                </execution>
              </executions>
            </plugin>

            <plugin>
              <groupId>org.apache.maven.plugins</groupId>
              <artifactId>maven-gpg-plugin</artifactId>
              <version>3.2.4</version>
              <executions>
                <execution>
                  <id>sign-artifacts</id>
                  <phase>verify</phase>
                  <goals><goal>sign</goal></goals>
                </execution>
              </executions>
            </plugin>

            <plugin>
              <groupId>org.apache.maven.plugins</groupId>
              <artifactId>maven-deploy-plugin</artifactId>
              <version>3.1.1</version>
            </plugin>
          </plugins>
        </pluginManagement>
        <plugins>
          <!-- Central Portal publisher (replaces old OSSRH/staging) -->
          <plugin>
            <groupId>org.sonatype.central</groupId>
            <artifactId>central-publishing-maven-plugin</artifactId>
            <version>0.9.0</version>
            <extensions>true</extensions>
            <configuration>
              <publishingServerId>central</publishingServerId>
              <autoPublish>true</autoPublish>        <!-- keep -->
              <waitUntil>validated</waitUntil>
              <ignorePublishedComponents>true</ignorePublishedComponents>
              <!-- Optional if you push SNAPSHOTs -->
              <centralSnapshotsUrl>https://central.sonatype.com/repository/maven-snapshots/</centralSnapshotsUrl>
            </configuration>
          </plugin>

          <plugin>
            <groupId>org.codehaus.mojo</groupId>
            <artifactId>flatten-maven-plugin</artifactId>
            <version>1.7.3</version>
            <configuration>
              <updatePomFile>true</updatePomFile> <!-- publish the flattened POM -->
              <flattenMode>bom</flattenMode>      <!-- or resolveCiFriendliesOnly if you prefer -->
              <flattenedPomFilename>${project.build.directory}/${project.artifactId}-${project.version}.pom</flattenedPomFilename>
            </configuration>
            <executions>
              <execution>
                <id>flatten</id>
                <phase>process-resources</phase>  <!-- before package/verify -->
                <goals><goal>flatten</goal></goals>
              </execution>
              <execution>
                <id>flatten.clean</id>
                <phase>clean</phase>
                <goals><goal>clean</goal></goals>
              </execution>
            </executions>


          </plugin>

          <!-- Attach sources -->
          <plugin>
            <groupId>org.apache.maven.plugins</groupId>
            <artifactId>maven-source-plugin</artifactId>
            <executions>
              <execution>
                <id>attach-sources</id>
                <phase>verify</phase>
                <goals><goal>jar</goal></goals>
              </execution>
            </executions>
          </plugin>

          <!-- Attach javadocs -->
          <plugin>
            <groupId>org.apache.maven.plugins</groupId>
            <artifactId>maven-javadoc-plugin</artifactId>
            <!--version>3.6.3</version-->
            <executions>
              <execution><id>attach-javadocs</id><goals><goal>jar</goal></goals></execution>
            </executions>
            <configuration><failOnError>false</failOnError></configuration>
          </plugin>

          <!-- ✅ GPG signing (Central requires .asc) -->
          <plugin>
            <groupId>org.apache.maven.plugins</groupId>
            <artifactId>maven-gpg-plugin</artifactId>
            <!--version>3.0.1</version-->
            <executions>
              <execution>
                <id>sign-artifacts</id>
                <phase>verify</phase>
                <goals><goal>sign</goal></goals>
              </execution>
            </executions>
            <configuration>
              <!-- Works with gpg2 and CI -->
              <!-- Use env vars: GPG_KEYNAME, GPG_PASSPHRASE, GPG_HOMEDIR (optional) -->
              <gpgArguments>
                <arg>--pinentry-mode</arg><arg>loopback</arg>
              </gpgArguments>
              <homedir>${env.GPG_HOMEDIR}</homedir>
              <!-- uncomment to force gpg2
              <executable>gpg2</executable>
              -->
            </configuration>
          </plugin>

          <!-- Keep legacy deploy plugin from poking at distributionManagement -->
          <plugin>
            <groupId>org.apache.maven.plugins</groupId>
            <artifactId>maven-deploy-plugin</artifactId>
            <!--version>3.1.2</version-->
            <configuration><skip>true</skip></configuration>
          </plugin>
        </plugins>

      </build>
    </profile>
    <profile>
      <id>security-scan</id>
      <activation>
        <property>
          <name>security-scan</name>
        </property>
      </activation>
      <build>
        <plugins>
          <!-- OWASP Dependency-Check Plugin - only runs when security-scan profile is active -->
          <plugin>
            <groupId>org.owasp</groupId>
            <artifactId>dependency-check-maven</artifactId>
            <executions>
              <execution>
                <goals>
                  <goal>check</goal>
                </goals>
              </execution>
            </executions>
          </plugin>
        </plugins>
      </build>
    </profile>
  </profiles>

  <build>
    <pluginManagement>
      <plugins>
        <!-- Maven Compiler Plugin -->
        <plugin>
          <groupId>org.apache.maven.plugins</groupId>
          <artifactId>maven-compiler-plugin</artifactId>
          <version>${maven.compiler.plugin.version}</version>
          <configuration>
            <source>${maven.compiler.source}</source>
            <target>${maven.compiler.target}</target>
          </configuration>
        </plugin>
        <!-- Maven Source Plugin -->
        <plugin>
          <groupId>org.apache.maven.plugins</groupId>
          <artifactId>maven-source-plugin</artifactId>
          <version>${maven.source.plugin.version}</version>
        </plugin>
        <!-- Maven Javadoc Plugin -->
        <plugin>
          <groupId>org.apache.maven.plugins</groupId>
          <artifactId>maven-javadoc-plugin</artifactId>
          <version>${maven.javadoc.plugin.version}</version>
        </plugin>
        <!-- Maven GPG Plugin -->
        <plugin>
          <groupId>org.apache.maven.plugins</groupId>
          <artifactId>maven-gpg-plugin</artifactId>
          <version>${maven.gpg.plugin.version}</version>
        </plugin>
        <!-- Maven Deploy Plugin -->
        <plugin>
          <groupId>org.apache.maven.plugins</groupId>
          <artifactId>maven-deploy-plugin</artifactId>
          <version>${maven.deploy.plugin.version}</version>
        </plugin>
        <!-- JaCoCo Code Coverage Plugin -->
        <plugin>
          <groupId>org.jacoco</groupId>
          <artifactId>jacoco-maven-plugin</artifactId>
          <version>${jacoco.plugin.version}</version>
        </plugin>
        <!-- CycloneDX SBOM Plugin -->
        <plugin>
          <groupId>org.cyclonedx</groupId>
          <artifactId>cyclonedx-maven-plugin</artifactId>
          <version>${cyclonedx.plugin.version}</version>
        </plugin>
        <!-- OWASP Dependency-Check Plugin -->
        <plugin>
          <groupId>org.owasp</groupId>
          <artifactId>dependency-check-maven</artifactId>
          <version>${owasp.plugin.version}</version>
        </plugin>
        <!-- Central Publishing Plugin -->
        <plugin>
          <groupId>org.sonatype.central</groupId>
          <artifactId>central-publishing-maven-plugin</artifactId>
          <version>${central.publishing.plugin.version}</version>
        </plugin>
        <!-- Flatten Maven Plugin -->
        <plugin>
          <groupId>org.codehaus.mojo</groupId>
          <artifactId>flatten-maven-plugin</artifactId>
          <version>${flatten.plugin.version}</version>
        </plugin>
      </plugins>
    </pluginManagement>

    <plugins>
      <plugin>
        <groupId>org.jacoco</groupId>
        <artifactId>jacoco-maven-plugin</artifactId>
        <version>0.8.13</version>
        <executions>
          <execution>
            <goals>
              <goal>prepare-agent</goal>
            </goals>
          </execution>
          <execution>
            <id>report</id>
            <phase>prepare-package</phase>
            <goals>
              <goal>report</goal>
            </goals>
          </execution>
          <execution>
            <id>check</id>
            <phase>verify</phase>
            <goals>
              <goal>check</goal>
            </goals>
            <configuration>
              <rules>
                <rule>
                  <element>BUNDLE</element>
                  <limits>
                    <!-- Fail build if instruction coverage is less than 60% -->
                    <limit>
                      <counter>INSTRUCTION</counter>
                      <value>COVEREDRATIO</value>
                      <minimum>0.50</minimum>
                    </limit>
                    <!-- Fail build if branch coverage is less than 60% -->
                    <limit>
                      <counter>BRANCH</counter>
                      <value>COVEREDRATIO</value>
                      <minimum>0.40</minimum>
                    </limit>
                  </limits>
                </rule>
              </rules>
            </configuration>
          </execution>
        </executions>
      </plugin>
      <!-- CycloneDX SBOM Plugin -->
      <plugin>
        <groupId>org.cyclonedx</groupId>
        <artifactId>cyclonedx-maven-plugin</artifactId>
        <version>2.8.2</version>
        <executions>
          <execution>
            <id>generate-sbom</id>
            <phase>package</phase>
            <goals>
              <goal>makeAggregateBom</goal>
            </goals>
          </execution>
        </executions>
        <configuration>
          <projectType>library</projectType>
          <schemaVersion>1.5</schemaVersion>
          <includeBomSerialNumber>true</includeBomSerialNumber>
          <includeCompileScope>true</includeCompileScope>
          <includeProvidedScope>true</includeProvidedScope>
          <includeRuntimeScope>true</includeRuntimeScope>
          <includeTestScope>false</includeTestScope>
          <includeSystemScope>true</includeSystemScope>
          <includeLicenseText>false</includeLicenseText>
          <outputReactorProjects>true</outputReactorProjects>
          <outputFormat>all</outputFormat>
          <outputName>cfc-core-sbom</outputName>
        </configuration>
      </plugin>
      <!-- OWASP Dependency-Check Plugin - configuration only (execution in security-scan profile) -->
      <plugin>
        <groupId>org.owasp</groupId>
        <artifactId>dependency-check-maven</artifactId>
        <version>12.1.0</version>
        <configuration>
          <!-- Fail build if CVSS score is 7 or higher (High/Critical) -->
          <failBuildOnCVSS>7</failBuildOnCVSS>
          <!-- Aggregate results from all modules -->
          <aggregate>true</aggregate>
          <!-- Output formats: HTML, JSON, CSV, XML, SARIF -->
          <formats>
            <format>HTML</format>
            <format>JSON</format>
            <format>XML</format>
            <format>SARIF</format>
          </formats>
          <!-- Suppress false positives -->
          <suppressionFiles>
            <suppressionFile>dependency-check-suppressions.xml</suppressionFile>
          </suppressionFiles>
          <!-- Enable experimental analyzers for better detection -->
          <assemblyAnalyzerEnabled>true</assemblyAnalyzerEnabled>
          <!-- Skip test dependencies -->
          <skipTestScope>true</skipTestScope>
          <!-- Use NVD API 2.0 with proper configuration -->
          <!-- The old JSON data feeds were deprecated and shut down by NIST -->
          <nvdApiKeyEnvironmentVariable>NVD_API_KEY</nvdApiKeyEnvironmentVariable>

          <!-- Enable NVD API usage -->
          <nvdApiServerId>nvd</nvdApiServerId>

          <!-- Rate limiting for API calls (recommended: 2000ms with API key, 6000ms without) -->
          <!-- With an API key, you get 50 requests per 30 seconds -->
          <nvdApiDelay>2000</nvdApiDelay>
          <nvdMaxRetryCount>10</nvdMaxRetryCount>

          <!-- API endpoint (uses v2.0) -->
          <nvdApiEndpoint>https://services.nvd.nist.gov/rest/json/cves/2.0</nvdApiEndpoint>

          <!-- Local cache directory -->
          <dataDirectory>${user.home}/.m2/dependency-check-data</dataDirectory>

          <!-- NVD Database Configuration -->
          <cveValidForHours>168</cveValidForHours>
          <autoUpdate>false</autoUpdate>

          <!-- WORKAROUND: Filter NVD data to avoid CVSS v4.0 parsing bugs -->
          <!-- Only fetch CVEs from mid-2020 to mid-2024 (pre-CVSS 4.0 era) -->
          <!-- This avoids the "SAFETY" enum parsing error -->
          <nvdApiStartDate>2020-01-01T00:00:00:000 UTC</nvdApiStartDate>
          <nvdApiEndDate>2024-06-01T00:00:00:000 UTC</nvdApiEndDate>

          <!-- Performance optimizations -->
          <centralAnalyzerUseCache>true</centralAnalyzerUseCache>

          <!-- ===== DISABLE ALL ANALYZERS THAT MAKE EXTERNAL API CALLS ===== -->
          <!-- Only use local file-based analysis to avoid 300k+ API requests -->

          <!-- Enable OSS Index (Sonatype) as alternative to NVD -->
          <!-- Uses Maven server credentials from settings.xml with id 'ossindex' -->
          <!-- See: https://jeremylong.github.io/DependencyCheck/dependency-check-maven/configuration.html -->
          <ossindexAnalyzerEnabled>true</ossindexAnalyzerEnabled>
          <ossindexAnalyzerUseCache>true</ossindexAnalyzerUseCache>
          <ossIndexServerId>ossindex</ossIndexServerId>

          <!-- Disable Node.js analyzers - not needed for Java project -->
          <nodeAuditAnalyzerEnabled>false</nodeAuditAnalyzerEnabled>
          <yarnAuditAnalyzerEnabled>false</yarnAuditAnalyzerEnabled>
          <pnpmAuditAnalyzerEnabled>false</pnpmAuditAnalyzerEnabled>
          <retirejmentsAnalyzerEnabled>false</retirejmentsAnalyzerEnabled>
          <nodePackageAnalyzerEnabled>false</nodePackageAnalyzerEnabled>

          <!-- Disable Ruby/Python analyzers - not needed for Java project -->
          <rubygemsAnalyzerEnabled>false</rubygemsAnalyzerEnabled>
          <bundleAuditAnalyzerEnabled>false</bundleAuditAnalyzerEnabled>
          <pyDistributionAnalyzerEnabled>false</pyDistributionAnalyzerEnabled>
          <pyPackageAnalyzerEnabled>false</pyPackageAnalyzerEnabled>
          <pipAnalyzerEnabled>false</pipAnalyzerEnabled>
          <pipfileAnalyzerEnabled>false</pipfileAnalyzerEnabled>
          <poetryAnalyzerEnabled>false</poetryAnalyzerEnabled>

          <!-- Disable Go/PHP/.NET analyzers - not needed for Java project -->
          <golangDepAnalyzerEnabled>false</golangDepAnalyzerEnabled>
          <golangModAnalyzerEnabled>false</golangModAnalyzerEnabled>
          <composerAnalyzerEnabled>false</composerAnalyzerEnabled>
          <nuspecAnalyzerEnabled>false</nuspecAnalyzerEnabled>
          <nugetconfAnalyzerEnabled>false</nugetconfAnalyzerEnabled>

          <!-- Disable Cocoapods/Swift/Carthage - not needed for Java project -->
          <cocoapodsAnalyzerEnabled>false</cocoapodsAnalyzerEnabled>
          <swiftPackageManagerAnalyzerEnabled>false</swiftPackageManagerAnalyzerEnabled>
          <carthageAnalyzerEnabled>false</carthageAnalyzerEnabled>

          <!-- Disable autoconf/cmake/msbuild - not needed for Java/Maven project -->
          <autoconfAnalyzerEnabled>false</autoconfAnalyzerEnabled>
          <cmakeAnalyzerEnabled>false</cmakeAnalyzerEnabled>
          <msbuildProjectAnalyzerEnabled>false</msbuildProjectAnalyzerEnabled>

          <!-- Disable archive analyzers that extract and scan nested JARs -->
          <!-- This dramatically reduces the number of files scanned -->
          <zipExtensions></zipExtensions>

          <!-- Enable ONLY the analyzers we actually need for Java/Maven -->
          <jarAnalyzerEnabled>true</jarAnalyzerEnabled>
          <centralAnalyzerEnabled>true</centralAnalyzerEnabled>
          <nexusAnalyzerEnabled>false</nexusAnalyzerEnabled>  <!-- Disable: makes API calls -->
          <artifactoryAnalyzerEnabled>false</artifactoryAnalyzerEnabled>  <!-- Disable: makes API calls -->
        </configuration>
      </plugin>
    </plugins>
  </build>

</project>