<?xml version="1.0" encoding="UTF-8"?>
<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">

	<modelVersion>4.0.0</modelVersion>

	<parent>
		<groupId>com.github.bordertech.common</groupId>
		<artifactId>bordertech-parent</artifactId>
		<version>1.0.12</version>
		<relativePath>../pom.xml</relativePath>
	</parent>

	<artifactId>qa-parent</artifactId>
	<packaging>pom</packaging>

	<properties>

		<!-- SKIP QA -->
		<bt.qa.skip>true</bt.qa.skip>
		<checkstyle.skip>${bt.qa.skip}</checkstyle.skip>
		<pmd.skip>${bt.qa.skip}</pmd.skip>
		<cpd.skip>${bt.qa.skip}</cpd.skip>
		<spotbugs.skip>${bt.qa.skip}</spotbugs.skip>

		<!-- Checkstyle -->
		<bt.checkstyle.config.file>bordertech/bt-checkstyle.xml</bt.checkstyle.config.file>

		<!-- PMD, CPD -->
		<bt.pmd.rules.file>bordertech/bt-pmd-rules.xml</bt.pmd.rules.file>
		<!-- Priority: 1 (High) - 5 (Low) -->
		<bt.pmd.failure.priority>2</bt.pmd.failure.priority>
		<bt.pmd.min.priority>3</bt.pmd.min.priority>

		<!-- Spotbugs  -->
		<bt.spotbugs.exclude.file>bordertech/bt-spotbugs-exclude-filter.xml</bt.spotbugs.exclude.file>
		<bt.spotbugs.exclude.files>${bt.spotbugs.exclude.file}</bt.spotbugs.exclude.files>
		<!-- Rank: Scariest (1-4), Scary (5-9), Troubling (10-14), Of concern (15-20) -->
		<bt.spotbugs.rank>14</bt.spotbugs.rank>
		<!-- Threshold Confidence: High, Medium, Low -->
		<bt.spotbugs.threshold>Medium</bt.spotbugs.threshold>

		<!-- OWASP dependency vulnerability scanner -->
		<bt.owasp.skip>false</bt.owasp.skip>
		<!-- Min cvss score to fail on. Range 0-10 : LOW: 0-3.9, MEDIUM: 4-6.9, HIGH: 7.0-8.9, Critical: 9.0-10.0 -->
		<bt.owasp.fail.cvss.min>0</bt.owasp.fail.cvss.min>
		<!-- If true, override min cvss and fail on any vulnerability. -->
		<bt.owasp.fail.any>false</bt.owasp.fail.any>
		<!-- If set, owasp uses the proxy id in maven settings to download its db. -->
		<bt.owasp.proxy.id />
	</properties>

	<description>
		Quality assurance configuration for BorderTech java projects.
		Note that projects inheriting from this POM also inherit the release
		configuration from bordertech-parent.
	</description>

	<dependencyManagement>
		<dependencies>
			<!-- Junit 5 -->
			<dependency>
				<groupId>org.junit.jupiter</groupId>
				<artifactId>junit-jupiter-engine</artifactId>
				<version>5.4.0</version>
				<scope>test</scope>
			</dependency>
			<!-- Junit 5 support for Junit 4 -->
			<dependency>
				<groupId>org.junit.vintage</groupId>
				<artifactId>junit-vintage-engine</artifactId>
				<scope>test</scope>
				<version>5.4.0</version>
			</dependency>
		</dependencies>
	</dependencyManagement>

	<build>
		<plugins>
			<!-- Code coverage. -->
			<plugin>
				<groupId>org.jacoco</groupId>
				<artifactId>jacoco-maven-plugin</artifactId>
				<version>0.8.3</version>
				<executions>
					<!-- Prepare Jacoco agent. -->
					<execution>
						<id>jacoco-agent</id>
						<goals>
							<goal>prepare-agent</goal>
						</goals>
					</execution>
					<!-- Jacoco Coverage Report -->
					<execution>
						<id>post-unit-test</id>
						<phase>prepare-package</phase>
						<goals>
							<goal>report</goal>
						</goals>
					</execution>
				</executions>
			</plugin>

			<!-- Surefire -->
			<plugin>
				<groupId>org.apache.maven.plugins</groupId>
				<artifactId>maven-surefire-plugin</artifactId>
				<version>2.22.1</version>
			</plugin>

			<!-- Verify: Check the code style. -->
			<plugin>
				<groupId>org.apache.maven.plugins</groupId>
				<artifactId>maven-checkstyle-plugin</artifactId>
				<version>3.0.0</version>
				<configuration>
					<configLocation>${bt.checkstyle.config.file}</configLocation>
					<consoleOutput>true</consoleOutput>
					<failsOnError>true</failsOnError>
					<failOnViolation>true</failOnViolation>
					<linkXRef>false</linkXRef>
					<includeTestSourceDirectory>false</includeTestSourceDirectory>
				</configuration>
				<dependencies>
					<!-- Latest checkstyle version -->
					<dependency>
						<groupId>com.puppycrawl.tools</groupId>
						<artifactId>checkstyle</artifactId>
						<version>8.18</version>
					</dependency>
					<!-- Bordertech config -->
					<dependency>
						<groupId>com.github.bordertech.common</groupId>
						<artifactId>build-tools</artifactId>
						<version>1.0.12</version>
					</dependency>
				</dependencies>
				<executions>
					<execution>
						<id>checkStyle</id>
						<phase>verify</phase>
						<goals>
							<goal>check</goal>
						</goals>
					</execution>
				</executions>
			</plugin>

			<!-- Verify: PMD and CPD Check. -->
			<plugin>
				<groupId>org.apache.maven.plugins</groupId>
				<artifactId>maven-pmd-plugin</artifactId>
				<version>3.11.0</version>
				<configuration>
					<failurePriority>${bt.pmd.failure.priority}</failurePriority>
					<minimumPriority>${bt.pmd.min.priority}</minimumPriority>
					<printFailingErrors>true</printFailingErrors>
					<includeTests>false</includeTests>
					<format>xml</format>
					<linkXRef>false</linkXRef>
					<rulesets>
						<ruleset>${bt.pmd.rules.file}</ruleset>
					</rulesets>
					<!-- Verbose allows warnings to be printed in the log -->
					<verbose>true</verbose>
				</configuration>
				<dependencies>
					<!-- Latest pmd version -->
					<dependency>
						<groupId>net.sourceforge.pmd</groupId>
						<artifactId>pmd-core</artifactId>
						<version>6.12.0</version>
					</dependency>
					<dependency>
						<groupId>net.sourceforge.pmd</groupId>
						<artifactId>pmd-java</artifactId>
						<version>6.12.0</version>
					</dependency>
					<dependency>
						<groupId>net.sourceforge.pmd</groupId>
						<artifactId>pmd-javascript</artifactId>
						<version>6.12.0</version>
					</dependency>
					<dependency>
						<groupId>net.sourceforge.pmd</groupId>
						<artifactId>pmd-jsp</artifactId>
						<version>6.12.0</version>
					</dependency>
					<!-- Bordertech config -->
					<dependency>
						<groupId>com.github.bordertech.common</groupId>
						<artifactId>build-tools</artifactId>
						<version>1.0.12</version>
					</dependency>
				</dependencies>
				<executions>
					<!-- PMD -->
					<execution>
						<id>checkPmd</id>
						<phase>verify</phase>
						<goals>
							<goal>check</goal>
						</goals>
					</execution>
					<!-- CPD (Warning only) -->
					<execution>
						<id>checkCpd</id>
						<phase>verify</phase>
						<configuration>
							<failOnViolation>false</failOnViolation>
						</configuration>
						<goals>
							<goal>cpd-check</goal>
						</goals>
					</execution>
				</executions>
			</plugin>

			<!-- Verify: Spotbugs check (new findbugs). -->
			<plugin>
				<groupId>com.github.spotbugs</groupId>
				<artifactId>spotbugs-maven-plugin</artifactId>
				<version>3.1.11</version>
				<configuration>
					<effort>Max</effort>
					<failOnError>true</failOnError>
					<includeTests>false</includeTests>
					<threshold>${bt.spotbugs.threshold}</threshold>
					<maxRank>${bt.spotbugs.rank}</maxRank>
					<excludeFilterFile>${bt.spotbugs.exclude.files}</excludeFilterFile>
					<plugins>
						<!-- Auxilary plugin -->
						<plugin>
							<groupId>com.mebigfatguy.fb-contrib</groupId>
							<artifactId>fb-contrib</artifactId>
							<version>7.4.3</version>
						</plugin>
						<!-- Security plugin -->
						<plugin>
							<groupId>com.h3xstream.findsecbugs</groupId>
							<artifactId>findsecbugs-plugin</artifactId>
							<version>1.8.0</version>
						</plugin>
					</plugins>
				</configuration>
				<executions>
					<execution>
						<id>checkSpotBugs</id>
						<phase>verify</phase>
						<goals>
							<goal>check</goal>
						</goals>
					</execution>
				</executions>
				<dependencies>
					<!-- Latest spotbugs version -->
					<dependency>
						<groupId>com.github.spotbugs</groupId>
						<artifactId>spotbugs</artifactId>
						<version>3.1.11</version>
					</dependency>
					<!-- Bordertech config. -->
					<dependency>
						<groupId>com.github.bordertech.common</groupId>
						<artifactId>build-tools</artifactId>
						<version>1.0.12</version>
					</dependency>
				</dependencies>
			</plugin>

			<!-- Verify: OWASP dependency vulnerability scanner. -->
			<plugin>
				<groupId>org.owasp</groupId>
				<artifactId>dependency-check-maven</artifactId>
				<version>5.0.0-M1</version>
				<configuration>
					<failBuildOnCVSS>${bt.owasp.fail.cvss.min}</failBuildOnCVSS>
					<failBuildOnAnyVulnerability>${bt.owasp.fail.any}</failBuildOnAnyVulnerability>
					<mavenSettingsProxyId>${bt.owasp.proxy.id}</mavenSettingsProxyId>
					<retireJsAnalyzerEnabled>false</retireJsAnalyzerEnabled><!-- see https://github.com/jeremylong/DependencyCheck/issues/1467 before turning this on -->
					<nuspecAnalyzerEnabled>false</nuspecAnalyzerEnabled>
					<swiftPackageManagerAnalyzerEnabled>false</swiftPackageManagerAnalyzerEnabled>
					<assemblyAnalyzerEnabled>false</assemblyAnalyzerEnabled>
					<skip>${bt.owasp.skip}</skip>
				</configuration>
				<executions>
					<execution>
						<id>checkDependencies</id>
						<phase>verify</phase>
						<goals>
							<goal>check</goal>
						</goals>
					</execution>
				</executions>
			</plugin>
		</plugins>
	</build>

</project>
