pom.xml

<?xml version="1.0" encoding="UTF-8"?>
<project xmlns="http://maven.apache.org/POM/4.0.0"
         xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
         xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
    <modelVersion>4.0.0</modelVersion>

    <groupId>io.github.randomcodespace.sonarpredict</groupId>
    <artifactId>sonar-predictor</artifactId>
    <version>0.3.0-SNAPSHOT</version>
    <!--
      Packaging is jar so the default Maven lifecycle binds compile, test,
      and jar plugins automatically. The "primary" jar this produces is
      our compiled classes only (~200 KB). The two RUNNABLE fat jars
      come from the maven-shade-plugin executions below, attached as
      classified artifacts (sonar-predictor-X.Y.Z-cli.jar /
      sonar-predictor-X.Y.Z-daemon.jar). Both are copied into the dist
      zip's lib/ directory by the assembly.
    -->
    <packaging>jar</packaging>
    <name>sonar-predictor</name>
    <description>Offline, no-server, pre-push code-quality gate. Embeds the genuine
        SonarSource analyzers (SonarLint engine + 10 language plugins) and runs them
        locally. Ships as a single distribution zip with launchers, fat jars and
        analyzer plugins.</description>
    <url>https://github.com/RandomCodeSpace/sonar-predict</url>
    <inceptionYear>2026</inceptionYear>

    <licenses>
        <license>
            <name>Apache License, Version 2.0</name>
            <url>https://www.apache.org/licenses/LICENSE-2.0.txt</url>
            <distribution>repo</distribution>
        </license>
    </licenses>

    <developers>
        <developer>
            <id>randomcodespace</id>
            <name>Amit Kumar</name>
            <url>https://github.com/RandomCodeSpace</url>
        </developer>
    </developers>

    <scm>
        <connection>scm:git:git://github.com/RandomCodeSpace/sonar-predict.git</connection>
        <developerConnection>scm:git:ssh://git@github.com/RandomCodeSpace/sonar-predict.git</developerConnection>
        <url>https://github.com/RandomCodeSpace/sonar-predict</url>
        <tag>HEAD</tag>
    </scm>

    <issueManagement>
        <system>GitHub Issues</system>
        <url>https://github.com/RandomCodeSpace/sonar-predict/issues</url>
    </issueManagement>

    <properties>
        <!--
          Java 21 minimum: sonarlint-analysis-engine 11.3.0.85510 (LTA 2026.1)
          ships class files at major version 65 (Java 21). Compiling against
          it requires a JDK 21+ toolchain. CI's setup-java step is pinned to
          21 in .github/workflows/*.yml to match.
        -->
        <maven.compiler.release>21</maven.compiler.release>
        <maven.compiler.source>21</maven.compiler.source>
        <maven.compiler.target>21</maven.compiler.target>
        <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>

        <jackson.version>2.17.2</jackson.version>
        <junit.version>5.10.2</junit.version>
        <!--
          These versions track SonarQube Server 2026.1 LTA (released 2025-12-11).

          To upgrade to a future LTA:
            1. Look up the new LTA's bundled analyzer versions in the release
               notes at https://docs.sonarsource.com/sonarqube-server/&lt;v&gt;/setup-and-upgrade/release-upgrade-notes/
            2. Bump all 11 version properties below.
            3. Run `mvn clean test` — the daemon test suite is the canary.
            4. If a NEW required host bean appears (NoSuchBeanDefinitionException
               on a type other than AnalysisWarnings), add an @SonarLintSide no-op
               class in src/main/java/.../hostplugin/ and one context.addExtension(...)
               line in SonarPredictHostPlugin.define(). See spec §7.2 for details.
        -->
        <sonarlint.engine.version>11.3.0.85510</sonarlint.engine.version>
        <picocli.version>4.7.7</picocli.version>

        <!--
          The 10 SonarSource analyzer plugins — the runtime assets the daemon
          loads. Single source of truth for the maven-dependency-plugin copy
          executions below, which fetch them through Maven (so settings.xml
          mirrors / Nexus / proxy apply). Versions match engine 11.3.0.85510 (LTA 2026.1).
        -->
        <sonar.plugin.java.version>8.29.0.43460</sonar.plugin.java.version>
        <sonar.plugin.python.version>5.22.0.33216</sonar.plugin.python.version>
        <sonar.plugin.javascript.version>12.5.0.41048</sonar.plugin.javascript.version>
        <sonar.plugin.php.version>3.57.0.15976</sonar.plugin.php.version>
        <sonar.plugin.kotlin.version>3.6.0.9326</sonar.plugin.kotlin.version>
        <sonar.plugin.go.version>1.18.1.827</sonar.plugin.go.version>
        <sonar.plugin.ruby.version>1.22.0.1992</sonar.plugin.ruby.version>
        <sonar.plugin.scala.version>1.23.0.2394</sonar.plugin.scala.version>
        <sonar.plugin.html.version>3.27.0.7699</sonar.plugin.html.version>
        <sonar.plugin.xml.version>2.17.0.7895</sonar.plugin.xml.version>
    </properties>

    <dependencyManagement>
        <dependencies>
            <dependency>
                <groupId>com.fasterxml.jackson.core</groupId>
                <artifactId>jackson-databind</artifactId>
                <version>${jackson.version}</version>
            </dependency>
            <dependency>
                <groupId>info.picocli</groupId>
                <artifactId>picocli</artifactId>
                <version>${picocli.version}</version>
            </dependency>
            <dependency>
                <groupId>org.junit</groupId>
                <artifactId>junit-bom</artifactId>
                <version>${junit.version}</version>
                <type>pom</type>
                <scope>import</scope>
            </dependency>
            <dependency>
                <groupId>org.sonarsource.sonarlint.core</groupId>
                <artifactId>sonarlint-analysis-engine</artifactId>
                <version>${sonarlint.engine.version}</version>
            </dependency>
        </dependencies>
    </dependencyManagement>

    <dependencies>
        <!-- Union of external dependencies from the former protocol, daemon,
             and cli modules. Inter-module deps are gone in single-module land. -->
        <dependency>
            <groupId>com.fasterxml.jackson.core</groupId>
            <artifactId>jackson-databind</artifactId>
        </dependency>
        <dependency>
            <groupId>info.picocli</groupId>
            <artifactId>picocli</artifactId>
        </dependency>
        <dependency>
            <groupId>org.sonarsource.sonarlint.core</groupId>
            <artifactId>sonarlint-analysis-engine</artifactId>
        </dependency>
        <dependency>
            <groupId>org.junit.jupiter</groupId>
            <artifactId>junit-jupiter</artifactId>
            <scope>test</scope>
        </dependency>
        <dependency>
            <groupId>org.assertj</groupId>
            <artifactId>assertj-core</artifactId>
            <version>3.27.7</version>
            <scope>test</scope>
        </dependency>
        <dependency>
            <groupId>org.mockito</groupId>
            <artifactId>mockito-core</artifactId>
            <version>5.15.2</version>
            <scope>test</scope>
        </dependency>
    </dependencies>

    <build>
        <pluginManagement>
            <plugins>
                <plugin>
                    <groupId>org.apache.maven.plugins</groupId>
                    <artifactId>maven-compiler-plugin</artifactId>
                    <version>3.13.0</version>
                </plugin>
                <plugin>
                    <groupId>org.apache.maven.plugins</groupId>
                    <artifactId>maven-surefire-plugin</artifactId>
                    <version>3.2.5</version>
                </plugin>
                <plugin>
                    <groupId>org.jacoco</groupId>
                    <artifactId>jacoco-maven-plugin</artifactId>
                    <!-- 0.8.13 adds class-file v69 (Java 25) support. Earlier
                         versions throw "Unsupported class file major version 69"
                         when test classes are compiled on Temurin 25. -->
                    <version>0.8.13</version>
                </plugin>
            </plugins>
        </pluginManagement>

        <plugins>
            <plugin>
                <groupId>org.apache.maven.plugins</groupId>
                <artifactId>maven-compiler-plugin</artifactId>
            </plugin>

            <!--
              Bind the primary jar to process-classes (instead of the default
              package phase). The shade executions below run in
              process-test-classes (before test), and they consume the primary
              jar — both must produce their output before the test phase fires,
              so DaemonLauncher tests can find a real daemon jar on disk.
            -->
            <plugin>
                <groupId>org.apache.maven.plugins</groupId>
                <artifactId>maven-jar-plugin</artifactId>
                <version>3.4.1</version>
                <executions>
                    <execution>
                        <id>default-jar</id>
                        <phase>process-classes</phase>
                        <goals><goal>jar</goal></goals>
                    </execution>
                    <execution>
                        <id>host-plugin-jar</id>
                        <phase>process-test-classes</phase>
                        <goals><goal>jar</goal></goals>
                        <configuration>
                            <classifier>host</classifier>
                            <includes>
                                <include>io/github/randomcodespace/sonarpredict/hostplugin/**</include>
                            </includes>
                            <archive>
                                <manifestEntries>
                                    <Plugin-Class>io.github.randomcodespace.sonarpredict.hostplugin.SonarPredictHostPlugin</Plugin-Class>
                                    <Plugin-Key>sonarpredict-host</Plugin-Key>
                                    <Plugin-Name>Sonar Predictor Host</Plugin-Name>
                                    <Plugin-Version>${project.version}</Plugin-Version>
                                    <Sonar-Version>9.9</Sonar-Version>
                                    <SonarLint-Supported>true</SonarLint-Supported>
                                </manifestEntries>
                            </archive>
                        </configuration>
                    </execution>
                </executions>
            </plugin>

            <!--
              JaCoCo instrumentation + XML report. Single module → one
              coverage report at target/site/jacoco/jacoco.xml. That XML
              feeds the scanner's coverage import flag; see README for the
              canonical invocation.
            -->
            <plugin>
                <groupId>org.jacoco</groupId>
                <artifactId>jacoco-maven-plugin</artifactId>
                <executions>
                    <execution>
                        <id>prepare-agent</id>
                        <goals><goal>prepare-agent</goal></goals>
                    </execution>
                    <execution>
                        <id>report</id>
                        <phase>verify</phase>
                        <goals><goal>report</goal></goals>
                    </execution>
                </executions>
            </plugin>

            <!--
              Fetch the 10 analyzer plugin jars through Maven. Two executions:

              1. process-test-resources → ${project.basedir}/plugins
                 RuleCatalog / PluginRuntime / SonarWayProfiles load analyzers
                 from that directory; jars are gitignored, so a clean checkout
                 (CI) has none until this populates them BEFORE tests run.

              2. prepare-package → ${project.build.directory}/plugins
                 The assembly descriptor pulls these into the dist zip's
                 plugins/ directory.

              Resolution goes through Maven both times, so settings.xml mirrors
              / Nexus / proxy all apply — no hardcoded download URLs, works
              behind corporate firewalls.
            -->
            <plugin>
                <groupId>org.apache.maven.plugins</groupId>
                <artifactId>maven-dependency-plugin</artifactId>
                <version>3.8.1</version>
                <executions>
                    <execution>
                        <id>copy-analyzer-plugins-for-tests</id>
                        <phase>process-test-resources</phase>
                        <goals><goal>copy</goal></goals>
                        <configuration>
                            <outputDirectory>${project.basedir}/plugins</outputDirectory>
                            <stripVersion>false</stripVersion>
                            <artifactItems>
                                <artifactItem><groupId>org.sonarsource.java</groupId><artifactId>sonar-java-plugin</artifactId><version>${sonar.plugin.java.version}</version><type>jar</type></artifactItem>
                                <artifactItem><groupId>org.sonarsource.python</groupId><artifactId>sonar-python-plugin</artifactId><version>${sonar.plugin.python.version}</version><type>jar</type></artifactItem>
                                <artifactItem><groupId>org.sonarsource.javascript</groupId><artifactId>sonar-javascript-plugin</artifactId><version>${sonar.plugin.javascript.version}</version><type>jar</type></artifactItem>
                                <artifactItem><groupId>org.sonarsource.php</groupId><artifactId>sonar-php-plugin</artifactId><version>${sonar.plugin.php.version}</version><type>jar</type></artifactItem>
                                <artifactItem><groupId>org.sonarsource.kotlin</groupId><artifactId>sonar-kotlin-plugin</artifactId><version>${sonar.plugin.kotlin.version}</version><type>jar</type></artifactItem>
                                <artifactItem><groupId>org.sonarsource.slang</groupId><artifactId>sonar-go-plugin</artifactId><version>${sonar.plugin.go.version}</version><type>jar</type></artifactItem>
                                <artifactItem><groupId>org.sonarsource.slang</groupId><artifactId>sonar-ruby-plugin</artifactId><version>${sonar.plugin.ruby.version}</version><type>jar</type></artifactItem>
                                <artifactItem><groupId>org.sonarsource.slang</groupId><artifactId>sonar-scala-plugin</artifactId><version>${sonar.plugin.scala.version}</version><type>jar</type></artifactItem>
                                <artifactItem><groupId>org.sonarsource.html</groupId><artifactId>sonar-html-plugin</artifactId><version>${sonar.plugin.html.version}</version><type>jar</type></artifactItem>
                                <artifactItem><groupId>org.sonarsource.xml</groupId><artifactId>sonar-xml-plugin</artifactId><version>${sonar.plugin.xml.version}</version><type>jar</type></artifactItem>
                            </artifactItems>
                        </configuration>
                    </execution>
                    <execution>
                        <id>copy-analyzer-plugins-for-dist</id>
                        <phase>prepare-package</phase>
                        <goals><goal>copy</goal></goals>
                        <configuration>
                            <outputDirectory>${project.build.directory}/plugins</outputDirectory>
                            <stripVersion>false</stripVersion>
                            <artifactItems>
                                <artifactItem><groupId>org.sonarsource.java</groupId><artifactId>sonar-java-plugin</artifactId><version>${sonar.plugin.java.version}</version><type>jar</type></artifactItem>
                                <artifactItem><groupId>org.sonarsource.python</groupId><artifactId>sonar-python-plugin</artifactId><version>${sonar.plugin.python.version}</version><type>jar</type></artifactItem>
                                <artifactItem><groupId>org.sonarsource.javascript</groupId><artifactId>sonar-javascript-plugin</artifactId><version>${sonar.plugin.javascript.version}</version><type>jar</type></artifactItem>
                                <artifactItem><groupId>org.sonarsource.php</groupId><artifactId>sonar-php-plugin</artifactId><version>${sonar.plugin.php.version}</version><type>jar</type></artifactItem>
                                <artifactItem><groupId>org.sonarsource.kotlin</groupId><artifactId>sonar-kotlin-plugin</artifactId><version>${sonar.plugin.kotlin.version}</version><type>jar</type></artifactItem>
                                <artifactItem><groupId>org.sonarsource.slang</groupId><artifactId>sonar-go-plugin</artifactId><version>${sonar.plugin.go.version}</version><type>jar</type></artifactItem>
                                <artifactItem><groupId>org.sonarsource.slang</groupId><artifactId>sonar-ruby-plugin</artifactId><version>${sonar.plugin.ruby.version}</version><type>jar</type></artifactItem>
                                <artifactItem><groupId>org.sonarsource.slang</groupId><artifactId>sonar-scala-plugin</artifactId><version>${sonar.plugin.scala.version}</version><type>jar</type></artifactItem>
                                <artifactItem><groupId>org.sonarsource.html</groupId><artifactId>sonar-html-plugin</artifactId><version>${sonar.plugin.html.version}</version><type>jar</type></artifactItem>
                                <artifactItem><groupId>org.sonarsource.xml</groupId><artifactId>sonar-xml-plugin</artifactId><version>${sonar.plugin.xml.version}</version><type>jar</type></artifactItem>
                            </artifactItems>
                        </configuration>
                    </execution>
                </executions>
            </plugin>

            <!--
              Two shade executions, one per launchable entry point. Each
              produces a classified, attached fat jar — packaging=pom keeps
              the default jar plugin off (no primary jar), so neither shaded
              artifact becomes the project's primary artifact. Both jars are
              copied into the dist zip's lib/ directory by the assembly.
            -->
            <plugin>
                <groupId>org.apache.maven.plugins</groupId>
                <artifactId>maven-shade-plugin</artifactId>
                <version>3.5.3</version>
                <executions>
                    <execution>
                        <id>shade-cli</id>
                        <phase>process-test-classes</phase>
                        <goals><goal>shade</goal></goals>
                        <configuration>
                            <!-- finalName drives the on-disk filename
                                 (target/<finalName>.jar). shadedClassifierName
                                 drives the deployed-artifact classifier
                                 (sonar-predictor-<version>-cli.jar on Central).
                                 The two are independent; the assembly picks the
                                 on-disk file up by literal name. -->
                            <finalName>sonar-predictor-cli-${project.version}</finalName>
                            <shadedArtifactAttached>true</shadedArtifactAttached>
                            <shadedClassifierName>cli</shadedClassifierName>
                            <transformers>
                                <transformer implementation="org.apache.maven.plugins.shade.resource.ManifestResourceTransformer">
                                    <mainClass>io.github.randomcodespace.sonarpredict.cli.SonarCommand</mainClass>
                                    <manifestEntries>
                                        <Implementation-Version>${project.version}</Implementation-Version>
                                    </manifestEntries>
                                </transformer>
                                <transformer implementation="org.apache.maven.plugins.shade.resource.ServicesResourceTransformer"/>
                            </transformers>
                            <filters>
                                <filter>
                                    <artifact>*:*</artifact>
                                    <excludes>
                                        <exclude>META-INF/*.SF</exclude>
                                        <exclude>META-INF/*.DSA</exclude>
                                        <exclude>META-INF/*.RSA</exclude>
                                    </excludes>
                                </filter>
                            </filters>
                        </configuration>
                    </execution>
                    <execution>
                        <id>shade-daemon</id>
                        <phase>process-test-classes</phase>
                        <goals><goal>shade</goal></goals>
                        <configuration>
                            <finalName>sonar-predictor-daemon-${project.version}</finalName>
                            <shadedArtifactAttached>true</shadedArtifactAttached>
                            <shadedClassifierName>daemon</shadedClassifierName>
                            <transformers>
                                <transformer implementation="org.apache.maven.plugins.shade.resource.ManifestResourceTransformer">
                                    <mainClass>io.github.randomcodespace.sonarpredict.daemon.DaemonMain</mainClass>
                                    <manifestEntries>
                                        <Implementation-Version>${project.version}</Implementation-Version>
                                    </manifestEntries>
                                </transformer>
                                <transformer implementation="org.apache.maven.plugins.shade.resource.ServicesResourceTransformer"/>
                            </transformers>
                            <filters>
                                <filter>
                                    <artifact>*:*</artifact>
                                    <excludes>
                                        <exclude>META-INF/*.SF</exclude>
                                        <exclude>META-INF/*.DSA</exclude>
                                        <exclude>META-INF/*.RSA</exclude>
                                    </excludes>
                                </filter>
                            </filters>
                        </configuration>
                    </execution>
                </executions>
            </plugin>

            <!--
              Copy the host plugin jar into the dev plugins/ directory so
              that AnalysisService (no-arg constructor → plugins/) and
              PluginRuntime.loadAll pick it up during mvn test.

              The host-plugin-jar jar-plugin execution (process-test-classes)
              produces target/sonar-predictor-${project.version}-host.jar.
              This antrun execution binds to the SAME phase so it runs
              immediately after the jar is written.

              The file is gitignored (plugins/*.jar). In production the host
              jar ships inside the dist zip's plugins/ directory via the
              assembly descriptor, so no separate production step is needed.
            -->
            <plugin>
                <groupId>org.apache.maven.plugins</groupId>
                <artifactId>maven-antrun-plugin</artifactId>
                <version>3.1.0</version>
                <executions>
                    <execution>
                        <id>copy-host-plugin-for-tests</id>
                        <phase>process-test-classes</phase>
                        <goals><goal>run</goal></goals>
                        <configuration>
                            <target>
                                <copy todir="${project.basedir}/plugins" overwrite="true">
                                    <fileset dir="${project.build.directory}">
                                        <include name="${project.artifactId}-${project.version}-host.jar"/>
                                    </fileset>
                                </copy>
                            </target>
                        </configuration>
                    </execution>
                </executions>
            </plugin>

            <!-- Assemble the dist bundle: bin/ launchers + lib/ fat jars +
                 plugins/ analyzer jars, zipped. Output:
                 target/sonar-predictor-dist-${project.version}.zip. -->
            <plugin>
                <groupId>org.apache.maven.plugins</groupId>
                <artifactId>maven-assembly-plugin</artifactId>
                <version>3.7.1</version>
                <executions>
                    <execution>
                        <id>build-dist-zip</id>
                        <phase>package</phase>
                        <goals><goal>single</goal></goals>
                        <configuration>
                            <appendAssemblyId>false</appendAssemblyId>
                            <finalName>sonar-predictor-dist-${project.version}</finalName>
                            <descriptors>
                                <descriptor>src/main/assembly/dist.xml</descriptor>
                            </descriptors>
                        </configuration>
                    </execution>
                </executions>
            </plugin>
        </plugins>
    </build>

    <profiles>
        <!--
          Maven Central publishing. Active only for the release build
          (`mvn -Prelease deploy`), which runs in CI on a `v*` tag.
          packaging=pom keeps source/javadoc Central requirements off the
          primary artifact; we attach only the source zip + dist zip below.
          GPG signs every attached artifact, then central-publishing-maven-plugin
          uploads through the Sonatype Central Portal.
        -->
        <profile>
            <id>release</id>
            <build>
                <plugins>
                    <!-- Maven Central requires source + javadoc jars for jar
                         packaging. doclint=none keeps a release from breaking on
                         missing @return tags. -->
                    <plugin>
                        <groupId>org.apache.maven.plugins</groupId>
                        <artifactId>maven-source-plugin</artifactId>
                        <version>3.3.1</version>
                        <executions>
                            <execution>
                                <id>attach-sources</id>
                                <phase>package</phase>
                                <goals><goal>jar-no-fork</goal></goals>
                            </execution>
                        </executions>
                    </plugin>

                    <plugin>
                        <groupId>org.apache.maven.plugins</groupId>
                        <artifactId>maven-javadoc-plugin</artifactId>
                        <version>3.10.1</version>
                        <configuration>
                            <doclint>none</doclint>
                            <failOnError>false</failOnError>
                        </configuration>
                        <executions>
                            <execution>
                                <id>attach-javadoc</id>
                                <phase>package</phase>
                                <goals><goal>jar</goal></goals>
                            </execution>
                        </executions>
                    </plugin>

                    <plugin>
                        <groupId>org.apache.maven.plugins</groupId>
                        <artifactId>maven-gpg-plugin</artifactId>
                        <version>3.2.7</version>
                        <executions>
                            <execution>
                                <id>sign-artifacts</id>
                                <phase>verify</phase>
                                <goals><goal>sign</goal></goals>
                            </execution>
                        </executions>
                    </plugin>

                    <plugin>
                        <groupId>org.sonatype.central</groupId>
                        <artifactId>central-publishing-maven-plugin</artifactId>
                        <version>0.6.0</version>
                        <extensions>true</extensions>
                        <configuration>
                            <publishingServerId>central</publishingServerId>
                            <autoPublish>true</autoPublish>
                            <waitUntil>validated</waitUntil>
                        </configuration>
                    </plugin>

                    <!--
                      Attach the dist zip (sonar-predictor-dist-${version}.zip)
                      and the whole-repo source zip (sonar-predict-${version}-src.zip,
                      produced by the publish workflow before `deploy` via
                      git archive) to the project coordinate.

                      Both ship on Maven Central, GPG-signed like every other
                      artifact. classifier=dist for the bundle and classifier=src
                      for the source zip.
                    -->
                    <plugin>
                        <groupId>org.codehaus.mojo</groupId>
                        <artifactId>build-helper-maven-plugin</artifactId>
                        <version>3.6.0</version>
                        <executions>
                            <execution>
                                <id>attach-deploy-artifacts</id>
                                <phase>package</phase>
                                <goals><goal>attach-artifact</goal></goals>
                                <configuration>
                                    <artifacts>
                                        <artifact>
                                            <file>${project.build.directory}/sonar-predictor-dist-${project.version}.zip</file>
                                            <type>zip</type>
                                            <classifier>dist</classifier>
                                        </artifact>
                                        <artifact>
                                            <file>${project.basedir}/sonar-predict-${project.version}-src.zip</file>
                                            <type>zip</type>
                                            <classifier>src</classifier>
                                        </artifact>
                                    </artifacts>
                                </configuration>
                            </execution>
                        </executions>
                    </plugin>
                </plugins>
            </build>
        </profile>
    </profiles>
</project>