<?xml version="1.0" encoding="UTF-8"?>
<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">

	<modelVersion>4.0.0</modelVersion>

	<parent>
		<groupId>com.github.bordertech.common</groupId>
		<artifactId>bordertech-parent</artifactId>
		<version>1.0.14</version>
		<relativePath>../pom.xml</relativePath>
	</parent>

	<artifactId>qa-parent</artifactId>
	<packaging>pom</packaging>

	<properties>

		<!-- SKIP QA -->
		<bt.qa.skip>true</bt.qa.skip>
		<checkstyle.skip>${bt.qa.skip}</checkstyle.skip>
		<pmd.skip>${bt.qa.skip}</pmd.skip>
		<cpd.skip>${bt.qa.skip}</cpd.skip>
		<spotbugs.skip>${bt.qa.skip}</spotbugs.skip>

		<!--
		These plugin settings are set as properties instead of being included in the default configuration to make it easier for projects to override.
		Property values are ignored if a default value is set in a configuation.
		-->
		<!-- Checkstyle -->
		<!-- Config file -->
		<checkstyle.config.location>bordertech/bt-checkstyle.xml</checkstyle.config.location>
		<!-- PMD -->
		<!-- Priority: 1 (High) - 5 (Low) -->
		<pmd.failurePriority>2</pmd.failurePriority>
		<!-- Rules file -->
		<bt.pmd.rules.file>bordertech/bt-pmd-rules.xml</bt.pmd.rules.file>

		<!-- Spotbugs -->
		<!-- Effort -->
		<spotbugs.effort>Max</spotbugs.effort>
		<!-- Threshold Confidence: High, Medium, Low -->
		<spotbugs.threshold>Medium</spotbugs.threshold>
		<!-- Rank: Scariest (1-4), Scary (5-9), Troubling (10-14), Of concern (15-20) -->
		<spotbugs.maxRank>14</spotbugs.maxRank>

		<!-- OWASP -->
		<!-- Check every 12 hours (default is 4) -->
		<cveValidForHours>12</cveValidForHours>
		<!-- Min cvss score to fail on. Range 0-10 : LOW: 0-3.9, MEDIUM: 4-6.9, HIGH: 7.0-8.9, Critical: 9.0-10.0 (Default is 11 which means it never fails) -->
		<failBuildOnCVSS>4</failBuildOnCVSS>
		<!-- If set, owasp uses the proxy id in maven settings to download its db. -->
		<mavenSettingsProxyId />

		<!-- Versions -->
		<bt.junit.version>5.4.2</bt.junit.version>
		<bt.jacoco.plugin.version>0.8.4</bt.jacoco.plugin.version>
		<bt.surefire.plugin.version>2.22.2</bt.surefire.plugin.version>
		<bt.checkstyle.plugin.version>3.0.0</bt.checkstyle.plugin.version>
		<bt.checkstyle.version>8.21</bt.checkstyle.version>
		<bt.pmd.plugin.version>3.12.0</bt.pmd.plugin.version>
		<bt.pmd.version>6.15.0</bt.pmd.version>
		<bt.spotbugs.plugin.version>3.1.11</bt.spotbugs.plugin.version>
		<bt.fb-contrib.plugin.version>7.4.5</bt.fb-contrib.plugin.version>
		<bt.spotbugs.version>3.1.12</bt.spotbugs.version>
		<bt.findsecbugs.plugin.version>1.9.0</bt.findsecbugs.plugin.version>
		<bt.owasp.plugin.version>5.0.0-M3</bt.owasp.plugin.version>

	</properties>

	<description>
		Quality assurance configuration for BorderTech java projects.
		Note that projects inheriting from this POM also inherit the release
		configuration from bordertech-parent.
	</description>

	<dependencyManagement>
		<dependencies>
			<!-- Junit 5 -->
			<dependency>
				<groupId>org.junit.jupiter</groupId>
				<artifactId>junit-jupiter-engine</artifactId>
				<version>${bt.junit.version}</version>
				<scope>test</scope>
			</dependency>
			<!-- Junit 5 support for Junit 4 -->
			<dependency>
				<groupId>org.junit.vintage</groupId>
				<artifactId>junit-vintage-engine</artifactId>
				<scope>test</scope>
				<version>${bt.junit.version}</version>
			</dependency>
		</dependencies>
	</dependencyManagement>

	<build>
		<plugins>
			<!-- Code coverage. -->
			<plugin>
				<groupId>org.jacoco</groupId>
				<artifactId>jacoco-maven-plugin</artifactId>
				<version>${bt.jacoco.plugin.version}</version>
				<executions>
					<!-- Prepare Jacoco agent. -->
					<execution>
						<id>jacoco-agent</id>
						<goals>
							<goal>prepare-agent</goal>
						</goals>
					</execution>
					<!-- Jacoco Coverage Report -->
					<execution>
						<id>post-unit-test</id>
						<phase>prepare-package</phase>
						<goals>
							<goal>report</goal>
						</goals>
					</execution>
				</executions>
			</plugin>

			<!-- Surefire -->
			<plugin>
				<groupId>org.apache.maven.plugins</groupId>
				<artifactId>maven-surefire-plugin</artifactId>
				<version>${bt.surefire.plugin.version}</version>
			</plugin>

			<!-- Verify: Check the code style. -->
			<plugin>
				<groupId>org.apache.maven.plugins</groupId>
				<artifactId>maven-checkstyle-plugin</artifactId>
				<version>${bt.checkstyle.plugin.version}</version>
				<configuration>
					<failsOnError>true</failsOnError>
					<linkXRef>false</linkXRef>
					<consoleOutput>true</consoleOutput>
				</configuration>
				<dependencies>
					<!-- Latest checkstyle version -->
					<dependency>
						<groupId>com.puppycrawl.tools</groupId>
						<artifactId>checkstyle</artifactId>
						<version>${bt.checkstyle.version}</version>
					</dependency>
					<!-- Bordertech config -->
					<dependency>
						<groupId>com.github.bordertech.common</groupId>
						<artifactId>build-tools</artifactId>
						<version>1.0.14</version>
					</dependency>
				</dependencies>
				<executions>
					<execution>
						<id>checkStyle</id>
						<phase>verify</phase>
						<goals>
							<goal>check</goal>
						</goals>
					</execution>
				</executions>
			</plugin>

			<!-- Verify: PMD and CPD Check. -->
			<plugin>
				<groupId>org.apache.maven.plugins</groupId>
				<artifactId>maven-pmd-plugin</artifactId>
				<version>${bt.pmd.plugin.version}</version>
				<configuration>
					<rulesets>
						<ruleset>${bt.pmd.rules.file}</ruleset>
					</rulesets>
					<printFailingErrors>true</printFailingErrors>
					<linkXRef>false</linkXRef>
					<verbose>true</verbose>
				</configuration>
				<dependencies>
					<!-- Latest pmd version -->
					<dependency>
						<groupId>net.sourceforge.pmd</groupId>
						<artifactId>pmd-core</artifactId>
						<version>${bt.pmd.version}</version>
					</dependency>
					<dependency>
						<groupId>net.sourceforge.pmd</groupId>
						<artifactId>pmd-java</artifactId>
						<version>${bt.pmd.version}</version>
					</dependency>
					<dependency>
						<groupId>net.sourceforge.pmd</groupId>
						<artifactId>pmd-javascript</artifactId>
						<version>${bt.pmd.version}</version>
					</dependency>
					<dependency>
						<groupId>net.sourceforge.pmd</groupId>
						<artifactId>pmd-jsp</artifactId>
						<version>${bt.pmd.version}</version>
					</dependency>
					<!-- Bordertech config -->
					<dependency>
						<groupId>com.github.bordertech.common</groupId>
						<artifactId>build-tools</artifactId>
						<version>1.0.14</version>
					</dependency>
				</dependencies>
				<executions>
					<!-- PMD -->
					<execution>
						<id>checkPmd</id>
						<phase>verify</phase>
						<goals>
							<goal>check</goal>
						</goals>
					</execution>
					<!-- CPD (Warning only) -->
					<execution>
						<id>checkCpd</id>
						<phase>verify</phase>
						<configuration>
							<failOnViolation>false</failOnViolation>
						</configuration>
						<goals>
							<goal>cpd-check</goal>
						</goals>
					</execution>
				</executions>
			</plugin>

			<!-- Verify: Spotbugs check (new findbugs). -->
			<plugin>
				<groupId>com.github.spotbugs</groupId>
				<artifactId>spotbugs-maven-plugin</artifactId>
				<version>${bt.spotbugs.plugin.version}</version>
				<configuration>
					<plugins>
						<!-- Auxilary plugin -->
						<plugin>
							<groupId>com.mebigfatguy.fb-contrib</groupId>
							<artifactId>fb-contrib</artifactId>
							<version>${bt.fb-contrib.plugin.version}</version>
						</plugin>
						<!-- Security plugin -->
						<plugin>
							<groupId>com.h3xstream.findsecbugs</groupId>
							<artifactId>findsecbugs-plugin</artifactId>
							<version>${bt.findsecbugs.plugin.version}</version>
						</plugin>
					</plugins>
				</configuration>
				<executions>
					<execution>
						<id>checkSpotBugs</id>
						<phase>verify</phase>
						<goals>
							<goal>check</goal>
						</goals>
					</execution>
				</executions>
				<dependencies>
					<!-- Latest spotbugs version -->
					<dependency>
						<groupId>com.github.spotbugs</groupId>
						<artifactId>spotbugs</artifactId>
						<version>${bt.spotbugs.version}</version>
					</dependency>
					<!-- Bordertech config. -->
					<dependency>
						<groupId>com.github.bordertech.common</groupId>
						<artifactId>build-tools</artifactId>
						<version>1.0.14</version>
					</dependency>
				</dependencies>
			</plugin>

			<!-- Verify: OWASP dependency vulnerability scanner. -->
			<plugin>
				<groupId>org.owasp</groupId>
				<artifactId>dependency-check-maven</artifactId>
				<version>${bt.owasp.plugin.version}</version>
				<configuration>
					<retireJsAnalyzerEnabled>false</retireJsAnalyzerEnabled>
					<nuspecAnalyzerEnabled>false</nuspecAnalyzerEnabled>
					<swiftPackageManagerAnalyzerEnabled>false</swiftPackageManagerAnalyzerEnabled>
					<assemblyAnalyzerEnabled>false</assemblyAnalyzerEnabled>
				</configuration>
				<executions>
					<execution>
						<id>checkDependencies</id>
						<phase>verify</phase>
						<goals>
							<goal>check</goal>
						</goals>
					</execution>
				</executions>
			</plugin>

			<!-- Enforcer - Dependency Convergence -->
			<plugin>
				<groupId>org.apache.maven.plugins</groupId>
				<artifactId>maven-enforcer-plugin</artifactId>
				<executions>
					<execution>
						<id>enforcer</id>
						<goals>
							<goal>enforce</goal>
						</goals>
						<configuration>
							<rules>
								<dependencyConvergence />
							</rules>
						</configuration>
					</execution>
				</executions>
			</plugin>

			<!-- Display dependency versions -->
			<plugin>
				<groupId>org.codehaus.mojo</groupId>
				<artifactId>versions-maven-plugin</artifactId>
				<version>2.7</version>
				<executions>
					<execution>
						<id>display-version-updates</id>
						<phase>verify</phase>
						<goals>
							<goal>display-dependency-updates</goal>
							<goal>display-parent-updates</goal>
							<goal>display-plugin-updates</goal>
							<goal>display-property-updates</goal>
						</goals>
					</execution>
				</executions>
			</plugin>

		</plugins>
	</build>

</project>
