pom.xml

<?xml version="1.0" encoding="UTF-8"?>
<project xmlns="http://maven.apache.org/POM/4.0.0"
         xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
         xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
    <modelVersion>4.0.0</modelVersion>

    <groupId>se.deversity.async-test-lib</groupId>
    <artifactId>async-test-parent</artifactId>
    <version>1.14.2</version>
    <packaging>pom</packaging>

    <name>Async Test Library (parent)</name>
    <description>Reactor parent for the async-test-lib modules. Aggregation and shared build configuration only — the library itself is the async-test-lib module.</description>

    <modules>
        <!-- The library. Keeps the artifactId consumers already depend on. -->
        <module>async-test-lib</module>
        <!-- Opt-in Byte Buddy field-access agent. Carries the Premain-Class manifest. -->
        <module>async-test-agent</module>
        <!-- Opt-in ASM pre-scanner for Loom pinning sites. Its main code depends on nothing else
             here; its tests read the library's classes (#803). -->
        <module>async-test-analysis</module>
    </modules>
    <url>https://github.com/PIsberg/async-test-lib</url>

    <licenses>
        <license>
            <name>PolyForm Noncommercial License 1.0.0</name>
            <url>https://polyformproject.org/licenses/noncommercial/1.0.0/</url>
            <distribution>repo</distribution>
        </license>
    </licenses>

    <developers>
        <developer>
            <id>PIsberg</id>
            <name>Peter Isberg</name>
            <url>https://github.com/PIsberg</url>
        </developer>
    </developers>

    <scm>
        <url>https://github.com/PIsberg/async-test-lib</url>
        <connection>scm:git:https://github.com/PIsberg/async-test-lib.git</connection>
        <developerConnection>scm:git:https://github.com/PIsberg/async-test-lib.git</developerConnection>
    </scm>

    <issueManagement>
        <system>GitHub</system>
        <url>https://github.com/PIsberg/async-test-lib/issues</url>
    </issueManagement>

    <properties>
        <maven.compiler.source>21</maven.compiler.source>
        <maven.compiler.target>21</maven.compiler.target>
        <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
        <junit.jupiter.version>6.1.3</junit.jupiter.version>
        <junit.platform.version>6.1.3</junit.platform.version>
        <jazzer.version>0.30.0</jazzer.version>
        <apiguardian.version>1.1.2</apiguardian.version>
        <!-- License mock mode: default true so tests run without a real key; override with -Dlicense.mock.mode=false -->
        <license.mock.mode>true</license.mock.mode>
        <!-- Local `mvn test` runs the plain-JUnit tier only; @Tag("e2e") classes (the
             EngineTestKit engine tests and agent end-to-end tests) run in CI and under
             -P e2e, which clears both properties below. The jacoco check gate is skipped
             alongside them because the e2e tier carries most runner/extension coverage:
             a skipped gate is logged by jacoco, and CI always runs it. -->
        <surefire.excludedGroups>e2e</surefire.excludedGroups>
        <jacoco.check.skip>true</jacoco.check.skip>
        <!-- Concurrent test JVMs. reuseForks=false already gives every class its own JVM, so
             raising this changes wall-clock only: concurrent forks share no static state
             (ThreadLocal contexts, static registries, per-JVM license and benchmark state), and
             isolation stays identical to a serial run. Mirrors build.gradle.kts's
             maxParallelForks, which has always defaulted to half the available processors. The
             Maven side sat at 1 with no way to override it: <forkCount> was a literal, and a
             literal beats -DforkCount, so the flag was accepted and ignored (under -X Surefire
             logs "(f) forkCount = 1" while still passing forkCount through as an inert system
             property). The default stays 1. Tests & Build's Ubuntu legs pass
             -Dsurefire.forkCount=2 (#898), decided on a soak because CI runners have 2 to 4 cores
             and run the e2e tier, whose timing margins were last widened in 938b4c4a to survive a
             loaded runner. The soak: 17 runs, 51 Ubuntu legs, 2026-10-04 to 10-05, with no failure
             and no timeout; the 66 runs before it had 17 failed legs, none a timeout. The test
             step's median went from 1,049 to 619 s on JDK 25 and 1,072 to 636 s on JDK 26 (those
             legs also dropped JaCoCo in #899; the one run between the two changes took 844 and
             823 s), and from 1,066 to 947 s on JDK 21, which still runs JaCoCo. macOS and Windows
             keep 1. -P fast raises it locally; override anywhere with -Dsurefire.forkCount=N. -->
        <surefire.forkCount>1</surefire.forkCount>
        <!-- Plugin versions -->
        <maven-compiler-plugin.version>3.16.0</maven-compiler-plugin.version>
        <maven-surefire-plugin.version>3.6.1</maven-surefire-plugin.version>
        <maven-shade-plugin.version>3.6.2</maven-shade-plugin.version>
        <!-- Pinned because nothing else does: without it Maven falls back to its built-in
             default binding, which resolves maven-jar-plugin 2.4 (2013). That plugin writes
             the agent's Premain-Class manifest, and an unpinned version means a different
             Maven can write it differently. Pinning also brings it under Dependabot, which
             cannot see a plugin that declares no version. -->
        <maven-jar-plugin.version>3.5.1</maven-jar-plugin.version>
        <maven-source-plugin.version>3.4.0</maven-source-plugin.version>
        <maven-javadoc-plugin.version>3.12.0</maven-javadoc-plugin.version>
        <jacoco-maven-plugin.version>0.8.16</jacoco-maven-plugin.version>
        <build-helper-maven-plugin.version>3.6.2</build-helper-maven-plugin.version>
        <maven-gpg-plugin.version>3.2.8</maven-gpg-plugin.version>
        <cyclonedx-maven-plugin.version>2.9.3</cyclonedx-maven-plugin.version>
        <central-publishing-maven-plugin.version>0.12.0</central-publishing-maven-plugin.version>
        <vibetags.version>1.4.1</vibetags.version>
        <maven-checkstyle-plugin.version>3.6.0</maven-checkstyle-plugin.version>
        <checkstyle.version>14.4.0</checkstyle.version>
        <spotbugs-maven-plugin.version>4.10.5.0</spotbugs-maven-plugin.version>
        <spotbugs.version>4.10.5</spotbugs.version>
        <findsecbugs.version>1.14.0</findsecbugs.version>
        <maven-pmd-plugin.version>3.28.0</maven-pmd-plugin.version>
        <pitest-maven.version>1.30.2</pitest-maven.version>
        <pitest-junit5-plugin.version>1.2.3</pitest-junit5-plugin.version>
        <archunit.version>1.5.1</archunit.version>
        <jakarta.persistence.version>3.2.0</jakarta.persistence.version>
        <error-prone.version>2.52.0</error-prone.version>
        <nullaway.version>0.14.3</nullaway.version>
        <jspecify.version>1.0.1</jspecify.version>
        <asm.version>9.11.1</asm.version>
        <bytebuddy.version>1.18.17</bytebuddy.version>
        <ecj.version>3.46.100</ecj.version>
        <slf4j.version>2.0.20</slf4j.version>
        <!-- Shared with build.gradle.kts via the sync block there; BuildMetadataSyncTest pins the pair. -->
        <common-license-lib.version>0.6.0</common-license-lib.version>
        <!-- The PMD engine itself, pinned independently of the plugin: maven-pmd-plugin 3.28.0
             still defaults to PMD 7.17.0, which is the version that cannot resolve JDK types on
             a newer JDK than the build targets (see docs/QUALITY_GATES.md). Pinning it here also
             keeps Maven and Gradle on one engine — build.gradle.kts sets the same number. -->
        <pmd.version>7.29.0</pmd.version>
    </properties>

    <!-- Versions only. Modules declare what they actually use, so the core artifact does not
         inherit the agent's byte-buddy or the scanner's asm. -->
    <dependencyManagement>
        <dependencies>
            <dependency>
                <groupId>se.deversity.async-test-lib</groupId>
                <artifactId>async-test-lib</artifactId>
                <version>${project.version}</version>
            </dependency>
            <dependency>
                <groupId>org.apiguardian</groupId>
                <artifactId>apiguardian-api</artifactId>
                <version>${apiguardian.version}</version>
            </dependency>
            <dependency>
                <groupId>org.junit.jupiter</groupId>
                <artifactId>junit-jupiter-api</artifactId>
                <version>${junit.jupiter.version}</version>
            </dependency>
            <dependency>
                <groupId>org.junit.jupiter</groupId>
                <artifactId>junit-jupiter-engine</artifactId>
                <version>${junit.jupiter.version}</version>
            </dependency>
            <dependency>
                <groupId>org.junit.platform</groupId>
                <artifactId>junit-platform-launcher</artifactId>
                <version>${junit.platform.version}</version>
            </dependency>
            <dependency>
                <groupId>org.junit.platform</groupId>
                <artifactId>junit-platform-testkit</artifactId>
                <version>${junit.platform.version}</version>
            </dependency>
            <dependency>
                <groupId>com.code-intelligence</groupId>
                <artifactId>jazzer-api</artifactId>
                <version>${jazzer.version}</version>
            </dependency>
            <dependency>
                <groupId>se.deversity.common</groupId>
                <artifactId>common-license-lib</artifactId>
                <version>${common-license-lib.version}</version>
            </dependency>
            <dependency>
                <groupId>com.tngtech.archunit</groupId>
                <artifactId>archunit-junit5</artifactId>
                <version>${archunit.version}</version>
            </dependency>
            <dependency>
                <groupId>jakarta.persistence</groupId>
                <artifactId>jakarta.persistence-api</artifactId>
                <version>${jakarta.persistence.version}</version>
            </dependency>
            <dependency>
                <groupId>net.bytebuddy</groupId>
                <artifactId>byte-buddy</artifactId>
                <version>${bytebuddy.version}</version>
            </dependency>
            <dependency>
                <groupId>net.bytebuddy</groupId>
                <artifactId>byte-buddy-agent</artifactId>
                <version>${bytebuddy.version}</version>
            </dependency>
            <dependency>
                <groupId>org.ow2.asm</groupId>
                <artifactId>asm</artifactId>
                <version>${asm.version}</version>
            </dependency>
            <dependency>
                <groupId>org.ow2.asm</groupId>
                <artifactId>asm-tree</artifactId>
                <version>${asm.version}</version>
            </dependency>
            <dependency>
                <groupId>org.ow2.asm</groupId>
                <artifactId>asm-analysis</artifactId>
                <version>${asm.version}</version>
            </dependency>
            <dependency>
                <groupId>org.eclipse.jdt</groupId>
                <artifactId>ecj</artifactId>
                <version>${ecj.version}</version>
            </dependency>
            <dependency>
                <groupId>org.slf4j</groupId>
                <artifactId>slf4j-api</artifactId>
                <version>${slf4j.version}</version>
            </dependency>
        </dependencies>
    </dependencyManagement>

    <!-- Compile-time tooling only. Safe to inherit everywhere: none of it ships. -->
    <dependencies>
        <dependency>
            <groupId>com.github.spotbugs</groupId>
            <artifactId>spotbugs-annotations</artifactId>
            <version>${spotbugs.version}</version>
            <scope>provided</scope>
        </dependency>
        <dependency>
            <groupId>se.deversity.vibetags</groupId>
            <artifactId>vibetags-processor</artifactId>
            <version>${vibetags.version}</version>
            <scope>provided</scope>
        </dependency>
        <dependency>
            <groupId>com.google.errorprone</groupId>
            <artifactId>error_prone_annotations</artifactId>
            <version>${error-prone.version}</version>
            <scope>provided</scope>
        </dependency>
        <!-- JSpecify @Nullable — the annotation NullAway reads. Compile-time only:
             CLASS retention, so it never appears on the runtime classpath of a consumer. -->
        <dependency>
            <groupId>org.jspecify</groupId>
            <artifactId>jspecify</artifactId>
            <version>${jspecify.version}</version>
            <scope>provided</scope>
        </dependency>
    </dependencies>

    <build>
        <plugins>
            <!-- The Premain-Class manifest lives in async-test-agent; japicmp and pitest live in
                 async-test-lib. Everything below is shared by all three modules. -->
            <plugin>
                <groupId>org.apache.maven.plugins</groupId>
                <artifactId>maven-compiler-plugin</artifactId>
                <version>${maven-compiler-plugin.version}</version>
                <configuration>
                    <encoding>UTF-8</encoding>
                    <compilerArgs>
                        <arg>-XDcompilePolicy=simple</arg>
                        <!-- javac stops reporting at 100 errors by default, which silently
                             truncates the finding list during an analyser rollout: two rounds of
                             the NullAway migration both reported "200" because that was the cap,
                             not the count. Raise it so a count is a count. -->
                        <arg>-Xmaxerrs</arg>
                        <arg>20000</arg>
                        <arg>--should-stop=ifError=FLOW</arg>
                        <arg>-Xplugin:ErrorProne -Xep:NullAway:ERROR -XepOpt:NullAway:AnnotatedPackages=se.deversity.asynctest -Xep:ReferenceEquality:ERROR -Xep:StringConcatToTextBlock:ERROR -Xep:ExposedPrivateType:ERROR -Xep:UnusedVariable:ERROR -Xep:StatementSwitchToExpressionSwitch:ERROR -Xep:InlineMeSuggester:ERROR -Xep:PatternMatchingInstanceof:ERROR -Xep:StringSplitter:ERROR</arg>
                        <arg>-XDaddTypeAnnotationsToSymbol=true</arg>
                    </compilerArgs>
                    <annotationProcessorPaths>
                        <path>
                            <groupId>com.google.errorprone</groupId>
                            <artifactId>error_prone_core</artifactId>
                            <version>${error-prone.version}</version>
                        </path>
                        <path>
                            <groupId>com.uber.nullaway</groupId>
                            <artifactId>nullaway</artifactId>
                            <version>${nullaway.version}</version>
                        </path>
                        <path>
                            <groupId>se.deversity.vibetags</groupId>
                            <artifactId>vibetags-processor</artifactId>
                            <version>${vibetags.version}</version>
                        </path>
                    </annotationProcessorPaths>
                </configuration>
                <executions>
                    <!-- Error Prone runs on main sources only; test sources are excluded per project policy -->
                    <execution>
                        <id>default-testCompile</id>
                        <phase>test-compile</phase>
                        <goals><goal>testCompile</goal></goals>
                        <configuration>
                            <encoding>UTF-8</encoding>
                            <compilerArgs combine.self="override"/>
                            <annotationProcessorPaths>
                                <path>
                                    <groupId>se.deversity.vibetags</groupId>
                                    <artifactId>vibetags-processor</artifactId>
                                    <version>${vibetags.version}</version>
                                </path>
                            </annotationProcessorPaths>
                        </configuration>
                    </execution>
                </executions>
            </plugin>
            <plugin>
                <groupId>org.apache.maven.plugins</groupId>
                <artifactId>maven-surefire-plugin</artifactId>
                <version>${maven-surefire-plugin.version}</version>
                <configuration>
                    <forkCount>${surefire.forkCount}</forkCount>
                    <reuseForks>false</reuseForks>
                    <!-- Local default skips the @Tag("e2e") engine tier; the e2e profile
                         (auto-active in CI) clears this. E2eTagGuardTest pins the tag set. -->
                    <excludedGroups>${surefire.excludedGroups}</excludedGroups>
                    <!-- @{argLine} preserves JaCoCo's late-bound agent argLine.
                         allowAttachSelf permits AsyncTestAgent.selfAttach() to attach to the
                         forked test JVM (self-attach is disabled by default since JDK 9).
                         EnableDynamicAgentLoading stops the JDK printing its dynamic-agent warning
                         to System.err from the Attach Listener thread, whose context class loader
                         is null: surefire 3.6.0's stderr capture fails to initialise there, which
                         aborts the agent's InstrumentationImpl constructor ("Agent failed to
                         start!"), so every self-attach test fails under 3.6.0 without it. -->
                    <argLine>@{argLine} -Djdk.attach.allowAttachSelf=true -XX:+EnableDynamicAgentLoading</argLine>
                    <systemPropertyVariables>
                        <license.mock.mode>${license.mock.mode}</license.mock.mode>
                        <!-- A detector that throws during analysis is contained for consumers
                             (one broken detector must not discard the whole sweep) but that
                             containment made a broken detector indistinguishable from a clean
                             run, which is how five of them shipped. Fail our own build on it.
                             See se.deversity.asynctest.DetectorFailurePolicy. -->
                        <async-test.strict-detectors>true</async-test.strict-detectors>
                    </systemPropertyVariables>
                    <!-- Deliberately no <rerunFailingTestsCount>: this library exists to surface
                         concurrency bugs (races, deadlocks, missed signals) under maximum thread
                         contention. A test that fails intermittently is reporting a real detector
                         finding, not infrastructure noise — auto-rerunning it would mask the exact
                         signal this project is built to catch. Flaky == signal here, not noise. -->
                </configuration>
            </plugin>
            <!-- JAR with sources -->
            <plugin>
                <groupId>org.apache.maven.plugins</groupId>
                <artifactId>maven-source-plugin</artifactId>
                <version>${maven-source-plugin.version}</version>
                <executions>
                    <execution>
                        <id>attach-sources</id>
                        <goals>
                            <goal>jar-no-fork</goal>
                        </goals>
                    </execution>
                </executions>
            </plugin>
            <!-- JavaDoc JAR -->
            <plugin>
                <groupId>org.apache.maven.plugins</groupId>
                <artifactId>maven-javadoc-plugin</artifactId>
                <version>${maven-javadoc-plugin.version}</version>
                <executions>
                    <execution>
                        <id>attach-javadocs</id>
                        <goals>
                            <goal>jar</goal>
                        </goals>
                    </execution>
                </executions>
                <configuration>
                    <doclint>all</doclint>
                    <encoding>UTF-8</encoding>
                    <docencoding>UTF-8</docencoding>
                </configuration>
            </plugin>
            <!-- Code coverage -->
            <plugin>
                <groupId>org.jacoco</groupId>
                <artifactId>jacoco-maven-plugin</artifactId>
                <version>${jacoco-maven-plugin.version}</version>
                <executions>
                    <execution>
                        <goals>
                            <goal>prepare-agent</goal>
                        </goals>
                        <configuration>
                            <!-- Only this project's classes: the report covers nothing else, and with no
                                 includes every per-class test JVM instrumented every class it loaded,
                                 JUnit, Byte Buddy and ASM among them (#897). The NamedModule*WeavingTest
                                 classes also need their named-module fixture to start without a read
                                 edge to the class path. JaCoCo's instrumentation gives it one before
                                 the agent attaches, which voids the test's premise (#668, #862). Test
                                 fixture code; no coverage is lost. Both mirrored in build.gradle.kts and
                                 pinned by JacocoInstrumentsTheProjectOnlyTest. -->
                            <includes>
                                <include>se.deversity.*</include>
                            </includes>
                            <excludes>
                                <exclude>com.example.namedfixture.*</exclude>
                            </excludes>
                        </configuration>
                    </execution>
                    <execution>
                        <id>report</id>
                        <phase>test</phase>
                        <goals>
                            <goal>report</goal>
                        </goals>
                    </execution>
                    <!-- The 70%/65% coverage gate is declared in async-test-lib. The agent and
                         the pinning scanner are thin instrumentation wrappers whose coverage
                         shape differs; gating them on the library's ratios would be arbitrary. -->
                </executions>
            </plugin>
            <!-- SBOM Generation -->
            <plugin>
                <groupId>org.cyclonedx</groupId>
                <artifactId>cyclonedx-maven-plugin</artifactId>
                <version>${cyclonedx-maven-plugin.version}</version>
                <executions>
                    <execution>
                        <phase>package</phase>
                        <goals>
                            <goal>makeAggregateBom</goal>
                        </goals>
                    </execution>
                </executions>
                <configuration>
                    <projectType>library</projectType>
                    <schemaVersion>1.6</schemaVersion>
                    <includeBomSerialNumber>true</includeBomSerialNumber>
                    <includeCompileScope>true</includeCompileScope>
                    <includeProvidedScope>true</includeProvidedScope>
                    <includeRuntimeScope>true</includeRuntimeScope>
                    <includeSystemScope>true</includeSystemScope>
                    <includeTestScope>false</includeTestScope>
                    <!-- "all" writes both target/bom.xml and target/bom.json. Both are attached to
                         the GitHub release and signed by publish.yml, which referenced bom.json from
                         the start while this said "xml": the JSON was silently skipped by the
                         `if [ -f ]` guard there for every release up to and including v1.11.2.
                         Consumers that ingest an SBOM (Dependency-Track, grype, trivy) read JSON. -->
                    <outputFormat>all</outputFormat>
                    <outputName>bom</outputName>
                </configuration>
            </plugin>
            <!-- PMD static analysis — main sources only -->
            <plugin>
                <groupId>org.apache.maven.plugins</groupId>
                <artifactId>maven-pmd-plugin</artifactId>
                <version>${maven-pmd-plugin.version}</version>
                <dependencies>
                    <!-- Override the PMD the plugin ships with; see ${pmd.version} above. -->
                    <dependency>
                        <groupId>net.sourceforge.pmd</groupId>
                        <artifactId>pmd-core</artifactId>
                        <version>${pmd.version}</version>
                    </dependency>
                    <dependency>
                        <groupId>net.sourceforge.pmd</groupId>
                        <artifactId>pmd-java</artifactId>
                        <version>${pmd.version}</version>
                    </dependency>
                </dependencies>
                <configuration>
                    <includeTests>false</includeTests>
                    <failOnViolation>true</failOnViolation>
                    <printFailingErrors>true</printFailingErrors>
                    <rulesets>
                        <ruleset>${maven.multiModuleProjectDirectory}/pmd-ruleset.xml</ruleset>
                    </rulesets>
                    <excludeRoots>
                        <excludeRoot>src/test/java</excludeRoot>
                    </excludeRoots>
                    <excludes>
                        <!-- NoopAsyncTestListener is intentionally empty (ignored element per CLAUDE.md) -->
                        <exclude>**/NoopAsyncTestListener.java</exclude>
                    </excludes>
                </configuration>
                <executions>
                    <execution>
                        <id>pmd-check</id>
                        <phase>verify</phase>
                        <goals>
                            <goal>check</goal>
                        </goals>
                    </execution>
                </executions>
            </plugin>
            <!-- SpotBugs static analysis — main sources only -->
            <plugin>
                <groupId>com.github.spotbugs</groupId>
                <artifactId>spotbugs-maven-plugin</artifactId>
                <version>${spotbugs-maven-plugin.version}</version>
                <configuration>
                    <effort>Max</effort>
                    <threshold>Low</threshold>
                    <includeTests>false</includeTests>
                    <xmlOutput>true</xmlOutput>
                    <failOnError>true</failOnError>
                    <excludeFilterFile>${maven.multiModuleProjectDirectory}/spotbugs-exclude.xml</excludeFilterFile>
                    <!-- find-sec-bugs adds 121 detectors covering 144 bug patterns (counted from
                         the plugin jar's own findbugs.xml) on top of SpotBugs' own,
                         inside the existing gate rather than as a new one. This library holds
                         three crypto detectors, a deserialization path guarded by an
                         ObjectInputFilter allow-list, and a security-critical LicenseGuard;
                         CodeQL covers the same ground from a different angle, and two
                         independent security analysers disagreeing is information. -->
                    <plugins>
                        <plugin>
                            <groupId>com.h3xstream.findsecbugs</groupId>
                            <artifactId>findsecbugs-plugin</artifactId>
                            <version>${findsecbugs.version}</version>
                        </plugin>
                    </plugins>
                </configuration>
                <executions>
                    <execution>
                        <id>spotbugs-check</id>
                        <phase>verify</phase>
                        <goals>
                            <goal>check</goal>
                        </goals>
                    </execution>
                </executions>
            </plugin>
            <!-- Checkstyle static analysis — main sources only -->
            <plugin>
                <groupId>org.apache.maven.plugins</groupId>
                <artifactId>maven-checkstyle-plugin</artifactId>
                <version>${maven-checkstyle-plugin.version}</version>
                <dependencies>
                    <dependency>
                        <groupId>com.puppycrawl.tools</groupId>
                        <artifactId>checkstyle</artifactId>
                        <version>${checkstyle.version}</version>
                    </dependency>
                </dependencies>
                <configuration>
                    <configLocation>${maven.multiModuleProjectDirectory}/checkstyle.xml</configLocation>
                    <includeTestSourceDirectory>false</includeTestSourceDirectory>
                    <consoleOutput>true</consoleOutput>
                    <failOnViolation>true</failOnViolation>
                    <violationSeverity>warning</violationSeverity>
                    <excludes>**/NoopAsyncTestListener.java</excludes>
                </configuration>
                <executions>
                    <execution>
                        <id>checkstyle-check</id>
                        <phase>verify</phase>
                        <goals>
                            <goal>check</goal>
                        </goals>
                    </execution>
                </executions>
            </plugin>
            <!-- PITest is declared in async-test-lib: the 74% mutation gate was measured against
                 the library's own test suite and means nothing for the two wrapper modules. -->
        </plugins>
    </build>

    <!-- GPG signing — activated via the 'release' profile in CI -->
    <profiles>
        <profile>
            <id>release</id>
            <build>
                <plugins>
                    <plugin>
                        <groupId>org.apache.maven.plugins</groupId>
                        <artifactId>maven-gpg-plugin</artifactId>
                        <version>${maven-gpg-plugin.version}</version>
                        <executions>
                            <execution>
                                <id>sign-artifacts</id>
                                <phase>verify</phase>
                                <goals>
                                    <goal>sign</goal>
                                </goals>
                            </execution>
                        </executions>
                        <configuration>
                            <!-- Key is imported from MAVEN_GPG_PRIVATE_KEY env var before mvn runs -->
                            <gpgArguments>
                                <arg>--pinentry-mode</arg>
                                <arg>loopback</arg>
                            </gpgArguments>
                        </configuration>
                    </plugin>
                    <!-- Maven Central publishing via Sonatype Central Portal -->
                    <plugin>
                        <groupId>org.sonatype.central</groupId>
                        <artifactId>central-publishing-maven-plugin</artifactId>
                        <version>${central-publishing-maven-plugin.version}</version>
                        <extensions>true</extensions>
                        <configuration>
                            <!-- Matches <server id="central"> in settings.xml / setup-java action -->
                            <publishingServerId>central</publishingServerId>
                            <!-- Automatically release after validation (no manual portal action needed) -->
                            <autoPublish>true</autoPublish>
                            <!-- uploaded, not published: with autoPublish the publication proceeds
                                 server-side once the bundle is uploaded and validated, but waiting for
                                 the "published" state blocks mvn deploy on Central's pipeline for an
                                 unbounded time. Both v1.7.0 and v1.9.1 had the publish job killed
                                 mid-poll around the hour mark; both publications completed on Central
                                 anyway, and every post-upload step (cosign, SBOM, GitHub release) was
                                 lost and had to be reconstructed by hand. Waiting only for the upload
                                 lets those steps run; Central availability is verified separately. -->
                            <waitUntil>uploaded</waitUntil>
                        </configuration>
                    </plugin>
                </plugins>
            </build>
        </profile>
        <!-- Full suite: clears the e2e tag exclusion and re-enables the coverage gate.
             Auto-activated in GitHub Actions (which always sets the CI env var), so every
             workflow runs everything with no flag; opt in locally with -P e2e.
             See docs/analysis/test-profiles-and-detector-gaps.md. -->
        <profile>
            <id>e2e</id>
            <activation>
                <property>
                    <name>env.CI</name>
                </property>
            </activation>
            <properties>
                <surefire.excludedGroups></surefire.excludedGroups>
                <jacoco.check.skip>false</jacoco.check.skip>
            </properties>
        </profile>
        <!-- Fast local loop: same 190 test classes, no coverage instrumentation.
             JaCoCo costs more than everything else in `mvn test` combined, because the agent
             instruments afresh in each of the ~190 short-lived per-class JVMs and they all
             append to one exec file, which also throttles the parallel forks. Measured on a
             16-core Windows box, full local tier, all 190 classes green in every cell:

                 forkCount=1     jacoco on   504s     off   258s
                 forkCount=0.5C  jacoco on   426s     off   164s

             Nothing is gated on the coverage this run produces: jacoco-check binds to verify,
             which `mvn test` never reaches, and jacoco.check.skip is true outside -P e2e. Use
             -P e2e (or plain `mvn verify`) when the coverage numbers are the point. -->
        <profile>
            <id>fast</id>
            <properties>
                <jacoco.skip>true</jacoco.skip>
                <surefire.forkCount>0.5C</surefire.forkCount>
                <!-- Surefire's argLine interpolates @{argLine}, which jacoco:prepare-agent
                     normally defines. With the agent skipped nothing defines it and Surefire
                     would hand the forked JVM the literal string, so define it empty here. -->
                <argLine></argLine>
            </properties>
        </profile>
    </profiles>

</project>