<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
  xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
  <modelVersion>4.0.0</modelVersion>

  <groupId>io.mateu.workflow</groupId>
  <artifactId>eventconductor</artifactId>
  <version>2.18.0</version>
  <packaging>pom</packaging>

  <name>eventconductor</name>
  <description>Event-driven workflow orchestration engine for Spring Boot applications</description>
  <url>https://github.com/miguelperezcolom/eventconductor</url>

  <licenses>
    <license>
      <name>MIT License</name>
      <url>http://www.opensource.org/licenses/mit-license.php</url>
    </license>
  </licenses>

  <scm>
    <connection>scm:git:git@github.com:miguelperezcolom/eventconductor.git</connection>
    <developerConnection>scm:git:git@github.com:miguelperezcolom/eventconductor.git</developerConnection>
    <url>https://github.com/miguelperezcolom/eventconductor</url>
  </scm>

  <developers>
    <developer>
      <name>Miguel Pérez Colom</name>
      <url>https://github.com/miguelperezcolom/</url>
    </developer>
  </developers>

  <modules>
    <module>modules/process-index</module>
    <module>modules/workflow-engine</module>
      <module>modules/workflow-e2e</module>
      <module>modules/forms-engine</module>
      <module>modules/rule-runtime</module>
      <module>modules/rule-engine</module>
      <module>modules/workflow-maven-plugin</module>
      <module>modules/sample-worker</module>
      <module>modules/test-worker</module>
      <module>apps/orchestrator-standalone-app</module>
      <module>apps/projector-standalone-app</module>
      <module>apps/forms-standalone-app</module>
      <module>apps/rule-standalone-app</module>
      <module>apps/worker-standalone-app</module>
      <module>apps/dev-app</module>
      <module>modules/shared</module>
      <module>modules/worker-api</module>
      <module>modules/worker-kafka</module>
      <module>modules/worker-embedded</module>
      <module>modules/worker-codegen</module>
      <module>parents/task-module-parent</module>
      <module>parents/task-service-parent</module>
      <module>examples/greetings-tasks</module>
  </modules>

  <properties>
    <mateu.version>3.0-alpha.340</mateu.version>
    <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
    <java.version>21</java.version>
    <!-- Per-module line-coverage floor, overridden in each module's own pom. A floor,
         not a target: it exists so a module cannot regress, and it is raised when the
         module improves. -->
    <jacoco.line.minimum>0.40</jacoco.line.minimum>
    <maven.compiler.release>21</maven.compiler.release>
  </properties>

  <dependencyManagement>
    <dependencies>
      <!-- Security overrides — pull specific managed/transitive dependencies up to their
           CVE-fixed versions. Declared BEFORE the spring-boot-dependencies import so they win:
           property overrides (e.g. <tomcat.version>) do NOT apply to an *imported* BOM, only to a
           parent. Trivy gates the release on these (CVE-2026-40976/41293/54512/54513/42198/…).
           Revisit when the Spring Boot BOM catches up so these can be dropped. -->
      <dependency>
        <groupId>com.fasterxml.jackson.core</groupId>
        <artifactId>jackson-databind</artifactId>
        <version>2.22.2</version>
      </dependency>
      <dependency>
        <groupId>com.fasterxml.jackson.core</groupId>
        <artifactId>jackson-core</artifactId>
        <version>2.22.2</version>
      </dependency>
      <dependency>
        <groupId>org.apache.tomcat.embed</groupId>
        <artifactId>tomcat-embed-core</artifactId>
        <version>11.0.26</version>
      </dependency>
      <dependency>
        <groupId>org.apache.tomcat.embed</groupId>
        <artifactId>tomcat-embed-el</artifactId>
        <version>11.0.26</version>
      </dependency>
      <dependency>
        <groupId>org.apache.tomcat.embed</groupId>
        <artifactId>tomcat-embed-websocket</artifactId>
        <version>11.0.26</version>
      </dependency>
      <dependency>
        <groupId>org.postgresql</groupId>
        <artifactId>postgresql</artifactId>
        <version>42.7.13</version>
      </dependency>
      <dependency>
        <groupId>org.springframework.boot</groupId>
        <artifactId>spring-boot-dependencies</artifactId>
        <version>4.1.1</version>
        <type>pom</type>
        <scope>import</scope>
      </dependency>
        <dependency>
            <groupId>org.springframework.cloud</groupId>
            <artifactId>spring-cloud-dependencies</artifactId>
            <version>2025.1.3</version>
            <type>pom</type>
            <scope>import</scope>
        </dependency>
        <dependency>
            <groupId>org.springframework.ai</groupId>
            <artifactId>spring-ai-starter-mcp-server-webmvc</artifactId>
            <version>2.0.1</version>
        </dependency>
        <dependency>
            <groupId>org.springframework.ai</groupId>
            <artifactId>spring-ai-model</artifactId>
            <version>2.0.1</version>
        </dependency>
        <!-- Spring AI 2.0's MCP server pulls json-schema-validator 3.x; align the engine's
             own definition validators to the same major (the 1.5→3.0 API was rewritten).
             Overrides the 1.5.x pinned by the Spring Boot 4 BOM. -->
        <dependency>
            <groupId>com.networknt</groupId>
            <artifactId>json-schema-validator</artifactId>
            <version>3.0.7</version>
        </dependency>
    </dependencies>
  </dependencyManagement>

  <dependencies>

      <dependency>
          <groupId>org.springframework</groupId>
          <artifactId>spring-aspects</artifactId>
      </dependency>

  </dependencies>

  <build>
    <plugins>

      <plugin>
        <groupId>org.apache.maven.plugins</groupId>
        <artifactId>maven-compiler-plugin</artifactId>
        <version>3.16.0</version>
        <configuration>
          <release>${maven.compiler.release}</release>
          <!--
            Run the annotation processors that are on the classpath — Lombok, and Mateu's UI
            registration processor. Since JDK 23 javac no longer does that on its own, and the
            plugin follows it, so whether a module gets processing has been decided by accident:
            it worked wherever some dependency happened to pull a processor in, and stopped the
            moment one was pruned. sample-worker is where that surfaced — its @Slf4j classes lost
            their `log` field when the module dropped dependencies it genuinely did not need — but
            every module here was one dependency change away from the same silence, and the
            failure reads as a missing symbol rather than as "nothing was processed".
          -->
          <proc>full</proc>
          <!--
            Keep parameter names in the bytecode. There is no Spring Boot parent here to switch
            this on, and configuring the plugin at all is what silences the default: every jar
            this reactor published carried no MethodParameters attribute whatsoever.

            Spring resolves a handler argument by its name when the annotation does not carry one,
            so `@PathVariable String provider` — which is how all three git-webhook controllers are
            written — cannot be bound at all. Every POST to /workflow/webhooks/{provider},
            /forms/webhooks/{provider} and /rules/webhooks/{provider} failed with
            "Name for argument of type [java.lang.String] not specified", before the signature was
            even verified, so git webhooks have never worked in a released build. Naming each
            variable explicitly would fix those three; this fixes the class of bug, and is what the
            Boot parent would have done.
          -->
          <parameters>true</parameters>
        </configuration>
      </plugin>

      <!-- Unit tests -->
      <plugin>
        <groupId>org.apache.maven.plugins</groupId>
        <artifactId>maven-surefire-plugin</artifactId>
        <version>3.6.0</version>
      </plugin>

      <!-- Integration tests -->
      <plugin>
        <groupId>org.apache.maven.plugins</groupId>
        <artifactId>maven-failsafe-plugin</artifactId>
        <version>3.6.0</version>
        <executions>
          <execution>
            <goals>
              <goal>integration-test</goal>
              <goal>verify</goal>
            </goals>
            <configuration>
              <includes>
                <include>**/*IT.java</include>
              </includes>
            </configuration>
          </execution>
        </executions>
      </plugin>
      <plugin>
        <groupId>org.apache.maven.plugins</groupId>
        <artifactId>maven-source-plugin</artifactId>
        <version>3.3.1</version>
        <executions>
          <execution>
            <id>attach-sources</id>
            <goals>
              <goal>jar</goal>
            </goals>
          </execution>
        </executions>
      </plugin>

      <plugin>
        <groupId>org.apache.maven.plugins</groupId>
        <artifactId>maven-javadoc-plugin</artifactId>
        <version>3.12.0</version>
        <configuration>
          <source>21</source>
          <doclint>none</doclint>
          <failOnError>false</failOnError>
        </configuration>
        <executions>
          <execution>
            <id>attach-javadocs</id>
            <goals>
              <goal>jar</goal>
            </goals>
          </execution>
        </executions>
      </plugin>

      <plugin>
        <groupId>org.sonatype.central</groupId>
        <artifactId>central-publishing-maven-plugin</artifactId>
        <version>0.8.0</version>
        <extensions>true</extensions>
        <configuration>
          <publishingServerId>central</publishingServerId>
          <autoPublish>true</autoPublish>
        </configuration>
      </plugin>

        <plugin>
            <groupId>org.jacoco</groupId>
            <artifactId>jacoco-maven-plugin</artifactId>
            <version>0.8.13</version>
            <configuration>
                <excludes>
                    <!-- What is left out, and why. The list used to be long enough to hide most of
                         what carries risk in production — the outbox, the schedulers, the JPA
                         repositories, the message REST API, the MCP tools, the autoconfiguration and
                         the Git import were all excluded, so an 85% figure was measured over the
                         domain and application layers and said nothing about the rest. Two things
                         stay out, both because a test of them would assert nothing a compiler does
                         not already: -->
                    <!-- Generated protobuf/gRPC stubs. Not our code; regenerated from the .proto. -->
                    <exclude>io/mateu/workflow/rules/grpc/**</exclude>
                    <!-- Vaadin/Mateu view classes: declarative page definitions whose behaviour is
                         the framework's rendering, which needs a browser runtime to exercise. The
                         query services and adapters behind them are NOT excluded. -->
                    <exclude>io/mateu/workflow/infra/in/ui/**</exclude>
                    <!-- Same rule, same reason, for the test worker's pages: it lives under its
                         own package root rather than sharing io.mateu.workflow.infra with the
                         engine, so the pattern above does not reach it. -->
                    <exclude>io/mateu/testworker/infra/in/ui/**</exclude>
                </excludes>
            </configuration>
            <executions>
            <execution>
                <id>prepare-agent</id>
                <goals>
                    <goal>prepare-agent</goal>
                </goals>
            </execution>

            <execution>
                <id>report</id>
                <phase>test</phase>
                <goals>
                    <goal>report</goal>
                </goals>
            </execution>

            <execution>
                <id>check-coverage</id>
                <goals>
                    <goal>check</goal>
                </goals>
                <configuration>
                    <rules>
                        <rule>
                            <element>BUNDLE</element>
                            <limits>
                                <limit>
                                    <counter>LINE</counter>
                                    <value>COVEREDRATIO</value>
                                    <minimum>${jacoco.line.minimum}</minimum>
                                </limit>
                            </limits>
                        </rule>
                    </rules>
                </configuration>
            </execution>
        </executions>
        </plugin>
    </plugins>
  </build>

  <profiles>
    <!--
      Distributed test suite (TESTING.md §5, DIST-01…DIST-05). Excluded from the
      default build because it needs Docker (Testcontainers: PostgreSQL + Kafka)
      and takes minutes. Run with: mvn -Pdist-e2e -pl modules/workflow-dist-e2e -am verify
    -->
    <!--
      Browser end-to-end tests for the engine's UI. Excluded from the default build because the
      first run downloads a browser (~150 MB) and the suite drives a real one, which is slower and
      differently flaky from everything else here. Run with:
      mvn -Pui-e2e -pl modules/workflow-ui-e2e -am verify
    -->
    <profile>
      <id>ui-e2e</id>
      <modules>
        <module>modules/workflow-ui-e2e</module>
      </modules>
    </profile>

    <profile>
      <id>dist-e2e</id>
      <modules>
        <module>modules/workflow-dist-e2e</module>
      </modules>
    </profile>

    <!--
      Benchmark harness. Excluded from the default build: it is not a test, it produces
      measurements, and it needs PostgreSQL and Kafka that you provide.
      Run with: mvn -Pbenchmark -pl modules/workflow-benchmark -am compile exec:java
      See modules/workflow-benchmark/README.md.
    -->
    <profile>
      <id>benchmark</id>
      <modules>
        <module>modules/workflow-benchmark</module>
      </modules>
    </profile>

    <!--
      GPG signing only kicks in when the "release" profile is active, which is
      what the build-and-publish workflow does. CI builds (mvn verify) don't
      have a GPG key and would otherwise fail on the sign goal.
    -->
    <profile>
      <id>release</id>
      <build>
        <plugins>
          <plugin>
            <groupId>org.apache.maven.plugins</groupId>
            <artifactId>maven-gpg-plugin</artifactId>
            <version>3.2.8</version>
            <executions>
              <execution>
                <id>sign-artifacts</id>
                <phase>verify</phase>
                <goals>
                  <goal>sign</goal>
                </goals>
                <configuration>
                  <gpgArguments>
                    <arg>--pinentry-mode</arg>
                    <arg>loopback</arg>
                  </gpgArguments>
                </configuration>
              </execution>
            </executions>
          </plugin>
        </plugins>
      </build>
    </profile>
  </profiles>
</project>
