From 6f96c7cacec7d130d9765289d42da5ae80a7d4b2 Mon Sep 17 00:00:00 2001
From: Juraj Noge <juraj.noge@productboard.com>
Date: Wed, 29 Jul 2026 13:54:16 +0200
Subject: [PATCH] Attach sources/javadoc/signatures on deploy; trim reactor to
 published modules

Maven Central rejected the 3.0.1-pb.1 bundle: no sources jars, javadoc jars,
or GPG signatures were attached. The Atlassian central-pom parent only wires
those under its release profile (activated by `mvn release:perform`), so a plain
`mvn clean deploy` produced none of them.

Declare maven-source-plugin, maven-javadoc-plugin (doclint off), and
maven-gpg-plugin (sign bound to verify) directly in the build so every deploy
attaches all three. Also trim <modules> to core + spring-webmvc (the only
modules pb-universe consumes), dropping pact/wiremock/restassured/mockmvc/
spring-web-client/ktor-client/examples from the public release.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 pom.xml | 59 ++++++++++++++++++++++++++++++++++++++++++++++++++-------
 1 file changed, 52 insertions(+), 7 deletions(-)

diff --git a/pom.xml b/pom.xml
index ba886c15..58101ff2 100644
--- a/pom.xml
+++ b/pom.xml
@@ -95,16 +95,12 @@
         <maven.gpg.plugin.version>3.2.8</maven.gpg.plugin.version>
     </properties>
 
+    <!-- productboardlabs fork: only the modules pb-universe consumes are published.
+         spring-webmvc depends on core; the other upstream modules (pact, wiremock, restassured,
+         mockmvc, spring-web-client, ktor-client, examples) are dropped to keep the release footprint small. -->
     <modules>
         <module>openapi-request-validator-core</module>
-        <module>openapi-request-validator-pact</module>
-        <module>openapi-request-validator-wiremock-junit5</module>
-        <module>openapi-request-validator-restassured</module>
-        <module>openapi-request-validator-mockmvc</module>
         <module>openapi-request-validator-spring-webmvc</module>
-        <module>openapi-request-validator-spring-web-client</module>
-        <module>openapi-request-validator-ktor-client</module>
-        <module>openapi-request-validator-examples</module>
     </modules>
 
     <!--
@@ -511,6 +507,55 @@
                     </execution>
                 </executions>
             </plugin>
+            <!-- productboardlabs fork: attach sources, javadoc, and GPG signatures on every deploy.
+                 The Atlassian central-pom parent only wires these under its release profile (activated by
+                 `mvn release:perform`); a plain `mvn clean deploy` must declare them here or Central rejects
+                 the bundle ("Sources/Javadocs must be provided", "Missing signature"). -->
+            <plugin>
+                <groupId>org.apache.maven.plugins</groupId>
+                <artifactId>maven-source-plugin</artifactId>
+                <version>3.3.1</version>
+                <executions>
+                    <execution>
+                        <id>attach-sources</id>
+                        <goals>
+                            <goal>jar-no-fork</goal>
+                        </goals>
+                    </execution>
+                </executions>
+            </plugin>
+            <plugin>
+                <groupId>org.apache.maven.plugins</groupId>
+                <artifactId>maven-javadoc-plugin</artifactId>
+                <version>${maven.javadoc.plugin.version}</version>
+                <executions>
+                    <execution>
+                        <id>attach-javadocs</id>
+                        <goals>
+                            <goal>jar</goal>
+                        </goals>
+                    </execution>
+                </executions>
+                <configuration>
+                    <!-- Don't let strict doclint on a third-party codebase fail the release. -->
+                    <doclint>none</doclint>
+                    <failOnError>false</failOnError>
+                    <quiet>true</quiet>
+                </configuration>
+            </plugin>
+            <plugin>
+                <groupId>org.apache.maven.plugins</groupId>
+                <artifactId>maven-gpg-plugin</artifactId>
+                <executions>
+                    <execution>
+                        <id>sign-artifacts</id>
+                        <phase>verify</phase>
+                        <goals>
+                            <goal>sign</goal>
+                        </goals>
+                    </execution>
+                </executions>
+            </plugin>
             <!-- productboardlabs fork: publish to Maven Central via the Sonatype Central Portal
                  under io.github.productboardlabs (server id `central` from ~/.m2/settings.xml). -->
             <plugin>