build.gradle.kts

import com.vanniktech.maven.publish.JavaLibrary
import com.vanniktech.maven.publish.JavadocJar
import com.vanniktech.maven.publish.SourcesJar

plugins {
    `java-library`
    `maven-publish`
    signing
    pmd
    // Owns the Maven Central (Sonatype Central Portal) handshake: upload + finalize + publish in
    // one task. The de-facto standard publishing plugin for Gradle libraries.
    id("com.vanniktech.maven.publish") version "0.36.0"
    id("com.diffplug.spotless") version "7.0.4"
    // GraalVM native-image support: provides `nativeTest`, which runs the JUnit suite inside a
    // native image to verify the shipped RuntimeHints (see KeyringRuntimeHints). Exercised by the
    // `native` CI job; applying it has no effect on the ordinary JVM build.
    id("org.graalvm.buildtools.native") version "1.1.1"
}

group = providers.gradleProperty("group").get()
version = providers.gradleProperty("version").get()

val springBootVersion = providers.gradleProperty("springBootVersion").get()
val jnaVersion = providers.gradleProperty("jnaVersion").get()

repositories {
    mavenCentral()
}

java {
    // Java 17 baseline to maximize adoption; the build JDK may be newer (compiles
    // with --release 17, see below, so no separate JDK 17 install is required).
    sourceCompatibility = JavaVersion.VERSION_17
    targetCompatibility = JavaVersion.VERSION_17
    // Sources + javadoc jars are configured by the publishing plugin (mavenPublishing.configure below),
    // so they're not declared here to avoid registering the tasks twice.
}

// An "optional" dependency bucket: on the compile classpath here, but published to the POM as
// <optional>true</optional> (see publishing block) so it is NOT forced transitively onto consumers.
val optional by configurations.creating

configurations {
    // The Windows-only JNA dependency compiles into this library but must not leak onto every
    // consumer's runtime classpath, so route it through `optional` rather than `implementation`.
    compileOnly { extendsFrom(optional) }
    // The tests compile and run against the same Spring Boot that consumers provide, so let the
    // test classpath inherit the compileOnly (provided) dependencies — including `optional`, so the
    // Windows integration test has JNA available — instead of redeclaring them for tests.
    testImplementation { extendsFrom(compileOnly.get()) }
}

dependencies {
    // Spring Boot's ConfigData SPI. Provided by the consuming application at
    // runtime, so it stays compileOnly and never pins a version on consumers.
    compileOnly("org.springframework.boot:spring-boot:$springBootVersion")

    // Native read access to the Windows Credential Manager (no CLI exists there). OPTIONAL: only the
    // Windows backend uses it, so it is not imposed on macOS/Linux consumers. Published as
    // <optional>true</optional> (non-transitive) — Windows consumers add jna-platform themselves
    // (see README). Kept behind the NativeKeyring SPI so a Java 22+ FFM backend can replace it.
    optional("net.java.dev.jna:jna-platform:$jnaVersion")

    // Import Spring Boot's dependency-management BOM for tests only, so JUnit, AssertJ and
    // the JUnit Platform launcher are versioned to match the Boot version under test instead
    // of being pinned by hand. (The bare spring-boot-test artifact, unlike the starter, does
    // not pull these in transitively.)
    testImplementation(platform("org.springframework.boot:spring-boot-dependencies:$springBootVersion"))
    testImplementation("org.springframework.boot:spring-boot-test")
    testImplementation("org.junit.jupiter:junit-jupiter")
    testImplementation("org.assertj:assertj-core")
    testRuntimeOnly("org.junit.platform:junit-platform-launcher")

    // Required on GraalVM 21 only: Boot's reachability metadata registers AspectJ types, so the
    // native image build needs aspectjweaver on the classpath.
    testRuntimeOnly("org.aspectj:aspectjweaver:1.9.25.1")
}

pmd {
    toolVersion = "7.25.0"
    isConsoleOutput = true
    ruleSetFiles = files("config/pmd/ruleset.xml")
    ruleSets = listOf()
}

spotless {
    java {
        importOrder("java", "javax", "jakarta", "", "\\#")
        removeUnusedImports()
        trimTrailingWhitespace()
        endWithNewline()
    }
}

tasks.withType<JavaCompile>().configureEach {
    options.release.set(17)
    options.encoding = "UTF-8"
}

tasks.withType<Test>().configureEach {
    useJUnitPlatform()
}

tasks.withType<Javadoc>().configureEach {
    (options as StandardJavadocDocletOptions).addStringOption("Xdoclint:none", "-quiet")
}

graalvmNative {
    agent {
        defaultMode.set("standard")
        modes {
            standard {}
        }
    }
}

tasks.named<Jar>("jar") {
    manifest {
        attributes("Automatic-Module-Name" to "com.sugarfreebytes.spring.keyring")
    }
    from("LICENSE") { into("META-INF") }
}

// --- Publishing (Maven Central via the Sonatype Central Portal) -------------
// The vanniktech plugin owns the full Central Portal handshake: `publishToMavenCentral` uploads,
// finalizes the deployment, and (automaticRelease = true) publishes — one task, no manual staging
// API calls. SNAPSHOT versions are routed to the Central snapshots repository automatically.
// Credentials and the in-memory signing key are read from these environment variables (set in CI):
//   ORG_GRADLE_PROJECT_mavenCentralUsername / ORG_GRADLE_PROJECT_mavenCentralPassword
//   ORG_GRADLE_PROJECT_signingInMemoryKey   / ORG_GRADLE_PROJECT_signingInMemoryKeyPassword
mavenPublishing {
    // Plain Java library: also build and publish sources + javadoc jars.
    configure(JavaLibrary(javadocJar = JavadocJar.Javadoc(), sourcesJar = SourcesJar.Sources()))

    publishToMavenCentral(automaticRelease = true)
    signAllPublications()

    coordinates(group.toString(), "spring-keyring-config", version.toString())

    pom {
        name.set("spring-keyring-config")
        description.set(
            "Spring Boot ConfigData provider that resolves secrets from the host OS " +
                "credential store (macOS Keychain, Windows Credential Manager, Linux " +
                "Secret Service) via spring.config.import and \${keyring@...} placeholders " +
                "— a local-development alternative to dotenv / .env files."
        )
        url.set("https://github.com/sugarfreebytes/spring-keyring-config")
        licenses {
            license {
                name.set("The Apache License, Version 2.0")
                url.set("https://www.apache.org/licenses/LICENSE-2.0.txt")
            }
        }
        developers {
            developer {
                id.set("sugarfreebytes")
                name.set("SugarFreeBytes")
            }
        }
        scm {
            connection.set("scm:git:https://github.com/sugarfreebytes/spring-keyring-config.git")
            developerConnection.set("scm:git:ssh://git@github.com/sugarfreebytes/spring-keyring-config.git")
            url.set("https://github.com/sugarfreebytes/spring-keyring-config")
        }
    }
}

// The `optional` configuration is invisible to the `java` software component, so jna-platform is
// absent from the generated POM. Add it back as an optional (non-transitive) runtime dependency:
// Windows consumers opt in, everyone else is unaffected.
publishing {
    publications.withType<MavenPublication>().configureEach {
        pom.withXml {
            val dependencies = asNode().appendNode("dependencies")
            val jna = dependencies.appendNode("dependency")
            jna.appendNode("groupId", "net.java.dev.jna")
            jna.appendNode("artifactId", "jna-platform")
            jna.appendNode("version", jnaVersion)
            jna.appendNode("scope", "runtime")
            jna.appendNode("optional", "true")
        }
    }
}