112-java-maven-plugins

# Maven Plugins: pom.xml Configuration Best Practices

Configure Maven plugins and profiles in pom.xml using a structured, question-driven process that preserves existing configuration. **This is an interactive SKILL**.

**What is covered in this Skill?**

Maven plugins:

- Maven Compiler
- Maven Enforcer
- Maven Surefire
- Maven Failsafe
- HTML test reports (Surefire Report, JXR)
- Maven Spotless
- Maven Flatten
- Maven Versions
- Maven Git Commit ID
- Maven Jib

Maven profiles:

- JaCoCo (code coverage)
- PiTest (mutation testing)
- Security (OWASP dependency check)
- Static analysis (SpotBugs, PMD)
- SonarQube/SonarCloud
- JMH (Java Microbenchmark Harness)
- Cyclomatic complexity

## Constraints

Before applying plugin recommendations, ensure the project is in a valid state. Use a structured, question-driven process that preserves existing configuration and adds only what the user selects.

- **MANDATORY**: Run `./mvnw validate` or `mvn validate` before applying any plugin recommendations
- **SAFETY**: If validation fails, stop and ask the user to fix issues—do not proceed until resolved
- **SCOPE**: Begin with Step 1 (existing configuration analysis) before any changes. Never remove or replace existing plugins; only add new ones that do not conflict
- **BEFORE READING PLUGIN REFERENCES**: Run the question flow embedded in this SKILL.md first. Ask questions one-by-one in strict order, collect all selected plugins/profiles and conditional values, then read only the implementation references selected by the user's answers

## When to use this skill

- Add Maven plugins in pom.xml
- Improve Maven plugins in pom.xml
- Configure Maven quality plugins in pom.xml
- Add Maven build lifecycle plugins for Java verification
- Review Maven plugin versions and executions

## Workflow

1. **Validate project before plugin changes**

Run `./mvnw validate` or `mvn validate` and stop if validation fails.

2. **Analyze current plugin and profile configuration**


Before making any changes to `pom.xml`:

1. Scan existing plugins in `<build><plugins>`, `<build><pluginManagement>`, and `<reporting><plugins>`.
2. Scan existing properties in `<properties>`.
3. Scan existing profiles in `<profiles>`.
4. Identify conflicts between existing configuration and possible additions.
5. Preserve all existing plugins, properties, and profiles.
6. Ask the user before enhancing any existing plugin, property, reporting entry, support file, or profile.
7. Skip duplicate additions unless the user explicitly requests an enhancement.


3. **Check Maven Wrapper before plugin changes**


Check for Maven Wrapper files in the project root:

- `mvnw` and `mvnw.cmd`
- `.mvn/wrapper/maven-wrapper.properties`

If Maven Wrapper is not present, stop and ask:

"I notice this project doesn't have Maven Wrapper configured. The Maven Wrapper ensures everyone uses the same Maven version, improving build consistency across different environments. Would you like me to install it? (y/n)"

Wait for the user's response before asking any other question. If the user says "y", install it:

```bash
mvn wrapper:wrapper
```


4. **Ask Maven plugin assessment questions before reading references**


Run this XML-included question flow before reading any plugin/profile implementation reference. Ask one question at a time, wait for the user's answer, and record selected plugins, profiles, and conditional values before continuing.


**Question 1**: What type of Java project is this?

Options:
- Java Library (for publishing to Maven Central/Nexus)
- Java CLI Application (command-line tool)
- Java Microservice (Web service/REST API/Modular monolith)
- Serverless (AWS Lambdas, Azure Functions)
- Java POC (Proof of Concept)
- Other (specify)

---

**Question 2**: Which Java version does your project target?

Options:

- Java 17 (LTS - recommended for new projects)
- Java 21 (LTS - latest LTS version)
- Java 25 (LTS - latest LTS version)
- Other (specify version)

---

**Question 3**: What build and quality aspects are important for your project?

Options:
- Format source code (Spotless)
- Maven Enforcer
- Unit Testing (Surefire)
- Unit Testing Reports (Surefire Reports)
- Integration testing (Failsafe)
- Code coverage reporting (JaCoCo)
- Mutation testing (PiTest)
- Security vulnerability scanning (OWASP)
- Security static code analysis (SpotBugs, PMD)
- Sonar
- Dependency analysis (maven-dependency-plugin)
- Version management
- Container image build (Jib)
- JMH (Java Microbenchmark Harness)
- Maven Compiler
- Cyclomatic Complexity

**Note**: When "Cyclomatic Complexity" is selected, Step 20 will create a PMD ruleset file and profile. The ruleset location depends on project structure: `src/main/pmd/pmd-cyclomatic-complexity.xml` (mono-module) or `pmd/pmd-cyclomatic-complexity.xml` (multi-module).

---

**Question 3.1** (conditional): What is your target container image for Jib?

**Note**: This question is only asked if "Container image build (Jib)" was selected in question 3.

- Example format: `gcr.io/my-project/my-app`, `docker.io/username/myimage`, or `myimage` for local Docker
- The image name will be used in the Jib plugin `<to><image>` configuration

---

**Question 4**:  What is your target coverage threshold?

Options:
- 70% (moderate)
- 80% (recommended)
- 90% (high)
- Custom percentage (specify)

**Note**: This question is only asked if "Code coverage reporting (JaCoCo)" was selected in question 3.

---

**Question 5**: Do you want to configure Sonar/SonarCloud integration?** (y/n)

**Note**: This question is only asked if "Static code analysis (SpotBugs, Sonar)" was selected in question 3.

**If yes, please provide the following information:**

---

**Question 5.1**: What is your Sonar organization identifier?

- For SonarCloud: This is typically your GitHub username or organization name
- For SonarQube: This is your organization key as configured in SonarQube
- Example: `my-github-user` or `my-company-org`

---

**Question 5.2**: What is your Son