Add this to your maven build plugin:
- Check to have only permissive OSS licenses
- Check for CVEs:
./mvnw clean org.sonatype.ossindex.maven:ossindex-maven-plugin:audit - Update dependency version:
./mvnw versions:update-properties; ./mvnw versions:use-latest-versions - Install the pre-commit hook to automtically run:
./mvnw spotless:apply
<plugin>
<groupId>org.honton.chas</groupId>
<artifactId>license-maven-plugin</artifactId>
<version>0.0.6</version>
<executions>
<execution>
<goals>
<goal>compliance</goal>
</goals>
</execution>
</executions>
<configuration>
<excludes>
<exclude>de.corp.*:*</exclude>
<exclude>ua_parser:ua-parser</exclude>
</excludes>
<acceptableLicenses>
<!-- for those with name only, the url did not work properly -->
<licens><name>GNU Lesser General Public License 2.1</name></licens>
<licens><name>LGPL 2.1</name></licens>
<licens><name>BSD New license</name></licens>
<licens><url>https?://aws.amazon.com/apache2.0</url></licens>
<licens><url>https?://github.com/dom4j/dom4j/blob/master/LICENSE</url></licens>
<licens><url>https?://github.com/javaee/javax.annotation/blob/master/LICENSE</url></licens>
<licens><url>https?://github.com/stleary/JSON-java/blob/master/LICENSE</url></licens>
<licens><url>https?://opensource.org/license/BSD-3-Clause</url></licens>
<licens><url>https?://opensource.org/licenses/MIT</url></licens>
<licens><url>https?://raw.github.com/hunterhacker/jdom/master/LICENSE.txt</url></licens>
<licens><url>https?://repository.jboss.org/licenses/apache-2.0.txt</url></licens>
<licens><url>https?://udger.com/legal/java_parser</url></licens>
<licens><url>https?://www.apache.org/licenses/LICENSE-2.0.txt</url></licens>
<licens><url>https?://www.bouncycastle.org/licence.html</url></licens>
<licens><url>https?://www.eclipse.org/legal/epl-2.0</url></licens>
<licens><url>https?://www.eclipse.org/org/documents/edl-v10.php</url></licens>
<licens><url>https?://www.eclipse.org/org/documents/epl-2.0/EPL-2.0.txt</url></licens>
<licens><url>https?://www.gnu.org/licenses/lgpl-3.0.html</url></licens>
<licens><url>https?://www.gnu.org/licenses/old-licenses/lgpl-2.1.txt</url></licens>
<licens><url>https?://www.gnu.org/software/classpath/license.html</url></licens>
<licens><url>https?://www.jcraft.com/jsch/LICENSE.txt</url></licens>
<licens><url>https?://www.opensource.org/licenses/mit-license.php</url></licens>
</acceptableLicenses>
<acceptableLicenseResources>osi-permissive</acceptableLicenseResources>
</configuration>
</plugin><plugin>
<!-- ./mvnw org.sonatype.ossindex.maven:ossindex-maven-plugin:audit -->
<groupId>org.sonatype.ossindex.maven</groupId>
<artifactId>ossindex-maven-plugin</artifactId>
<version>3.2.0</version>
<configuration>
<excludeVulnerabilityIds>
<!--rejected by redhat -->
<!--<exclude>CVE-2024-4109</exclude>-->
</excludeVulnerabilityIds>
</configuration>
<!--<executions>
<execution>
<id>audit-dependencies</id>
<phase>validate</phase>
<goals>
<goal>audit</goal>
</goals>
</execution>
</executions>-->
</plugin><plugin>
<!-- https://www.baeldung.com/maven-dependency-latest-version -->
<!-- ./mvnw versions:display-dependency-updates -->
<!-- ./mvnw versions:display-property-updates -->
<!-- ./mvnw versions:update-properties -->
<!-- ./mvnw versions:use-latest-versions -->
<!-- oneliner: ./mvnw versions:update-properties; ./mvnw versions:use-latest-versions -->
<groupId>org.codehaus.mojo</groupId>
<artifactId>versions-maven-plugin</artifactId>
<version>2.18.0</version>
<configuration>
<!-- groovy.version: is think it's too risky, we have extra processed to check for all active versions -->
<excludeProperties>groovy.version</excludeProperties>
<excludes>
<!-- exclusion in the configuration refers to the update process, and not to the discovery one. -->
<!-- "groupId:artifactId:type:classifier:version" -->
<exclude>commons-collections:commons-collections:*:*</exclude>
</excludes>
<ruleSet>
<rules>
<rule>
<!-- *, and version selector works exactly like this example, was quite hard to find out -->
<groupId>de.corp.rs.sn</groupId>
<artifactId>*</artifactId>
<ignoreVersions>
<ignoreVersion>
<type>exact</type>
<version>3.0</version> <!-- 3.0 is a bad release, DO NOT USE -->
</ignoreVersion>
</ignoreVersions>
</rule>
<rule>
<ignoreVersions>
<ignoreVersion>
<type>regex</type>
<version>.+-SNAPSHOT</version>
</ignoreVersion>
<ignoreVersion>
<type>regex</type>
<version>(?i).+(alpha|beta|B|rc|-m).*</version>
</ignoreVersion>
</ignoreVersions>
</rule>
</rules>
</ruleSet>
</configuration>
</plugin><plugin>
<!--
Before committing, run mvn spotless:apply in your terminal.
Because <ratchetFrom> is configured, Spotless will:
Identify files that have changed compared to origin/wildfly (or your specified ref).
Apply formatting only to those changed Java files.
Stage the changes (including any formatting adjustments made by Spotless).
Commit the code.
-->
<!-- https://github.com/palantir/palantir-java-format -->
<!-- use mvn com.diffplug.spotless:spotless-maven-plugin:apply to apply this plugin -->
<groupId>com.diffplug.spotless</groupId>
<artifactId>spotless-maven-plugin</artifactId>
<version>${spotless.version}</version>
<configuration>
<pom></pom>
<ratchetFrom>origin/main</ratchetFrom>
<!-- optional: limit format enforcement to just the files changed by this feature branch -->
<!-- define a language-specific format -->
<java>
<!--toggleOffOn /--> <!-- use // spotless:off and // spotless:on to exclude code from spotless reformatting -->
<!-- no need to specify files, inferred automatically, but you can if you want -->
<!-- apply a specific flavor of google-java-format and reflow long strings -->
<!--googleJavaFormat>
<version>1.19.2</version>
<style>AOSP</style>
<reflowLongStrings>true</reflowLongStrings>
<formatJavadoc>true</formatJavadoc>
</googleJavaFormat-->
<palantirJavaFormat>
<version>2.40.0</version> <!-- optional -->
<style>PALANTIR</style> <!-- or AOSP/GOOGLE (optional) -->
<!--formatJavadoc>true</formatJavadoc--> <!-- defaults to false (optional, requires at least Palantir 2.39.0) -->
</palantirJavaFormat>
<removeUnusedImports />
<formatAnnotations />
<importOrder />
<!-- make sure every file has the following copyright header.
optionally, Spotless can set copyright years by digging
through git history (see "license" section below) -->
<!-- <licenseHeader>
<content>/* (C)$YEAR */</content> <!– or <file>${project.basedir}/license-header</file> –>
</licenseHeader>-->
</java>
<formats>
<format>
<includes>
<include>src/main/resources/templates/**/*.html</include> <!-- Or wherever your fragments are -->
</includes>
<prettier>
<config>
<!-- Optional: Specify the Prettier version to use -->
<prettierVersion>3.5.3</prettierVersion>
<!-- Optional: Add specific Prettier options -->
<htmlWhitespaceSensitivity>css</htmlWhitespaceSensitivity>
<tabWidth>2</tabWidth>
<printWidth>180</printWidth>
</config>
</prettier>
</format>
</formats>
</configuration>
<executions>
<execution>
<!-- Keep the 'check' goal for CI -->
<id>spotless-check</id>
<goals>
<goal>check</goal>
</goals>
<phase>verify</phase> <!-- Run during verify phase in CI -->
</execution>
</executions>
</plugin>commit hook in ".git/hooks/pre-commit"
#!/bin/bash
echo "Running pre-commit hook..."
# Check if mvnw exists
if ! command -v ./mvnw &> /dev/null
then
echo "Maven (mvnw) could not be found, skipping Spotless check."
exit 0 # Or exit 1 if you want to enforce Maven presence
fi
# Check for staged Java files
STAGED_JAVA_FILES=$(git diff --name-only --cached --diff-filter=ACM -- '*.java')
if [ -z "$STAGED_JAVA_FILES" ]; then
echo "No Java files staged, skipping Spotless."
exit 0
fi
echo "Running mvnw spotless:apply (using ratchet configuration)..."
# Assuming <ratchetFrom> is configured in pom.xml
./mvnw spotless:apply -q # -q for quieter output
if [ $? -ne 0 ]; then
echo "Spotless formatting failed. Please fix formatting issues."
exit 1
fi
# Re-stage any files potentially modified by spotless:apply
# Be careful here, this re-adds ALL staged Java files. A more precise
# script might check git status again, but this is usually sufficient
# if spotless:apply only touches the files it's meant to.
echo "$STAGED_JAVA_FILES" | while IFS= read -r file; do
if [ -f "$file" ]; then # Ensure file exists
git add "$file"
fi
done
echo "Spotless formatting applied successfully."
exit 0