From 8cec9b2cc476fa171a783a22a88c0c428e6b36ed Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Thu, 13 Aug 2026 07:38:11 +0000
Subject: [PATCH] Attach sources and javadoc on every package, not only under
 -P deploy

maven-source-plugin and maven-javadoc-plugin lived in the deploy profile,
which has no activation block, so they only ran with an explicit -P deploy.
maven-publish.yml runs a plain mvn deploy, so the attach-sources and
attach-javadocs executions never fired and every artifact cfparser has
published is a bare jar with no source attachment and no javadoc.

Adding -P deploy to the workflow would not have worked: the same profile
carries maven-gpg-plugin bound to verify, and there is no signing key in CI,
so the publish would have started failing instead. Moving the two attach
plugins into the main build and leaving GPG behind in the profile separates
the two concerns -- artifact completeness is not a signing decision.

Both bind to the package phase, so mvn test is untouched. Measured cost on
package is 19.3s to 23.2s.

Versions pinned to the 3.4.0 and 3.12.0 that were already resolving from the
superpom, so the build stops moving underneath itself. maven-gpg-plugin
beside them was already pinned.

Dropped <additionalparam>-Xdoclint:none</additionalparam>. That parameter was
removed in maven-javadoc-plugin 3.x, so it has been silently doing nothing and
javadoc has been running with doclint on and passing. Deleting dead config
keeps behaviour exactly as it is today; replacing it with <doclint>none</doclint>
would newly relax checks that currently pass.

Closes #60
---
 pom.xml | 58 ++++++++++++++++++++++++++++++---------------------------
 1 file changed, 31 insertions(+), 27 deletions(-)

diff --git a/pom.xml b/pom.xml
index a016f63..4eb34eb 100644
--- a/pom.xml
+++ b/pom.xml
@@ -82,33 +82,6 @@
 
 			<build>
 				<plugins>
-					<plugin>
-						<groupId>org.apache.maven.plugins</groupId>
-						<artifactId>maven-source-plugin</artifactId>
-						<executions>
-							<execution>
-								<id>attach-sources</id>
-								<goals>
-									<goal>jar</goal>
-								</goals>
-							</execution>
-						</executions>
-					</plugin>
-					<plugin>
-						<groupId>org.apache.maven.plugins</groupId>
-						<artifactId>maven-javadoc-plugin</artifactId>
-						<executions>
-							<execution>
-								<id>attach-javadocs</id>
-								<goals>
-									<goal>jar</goal>
-								</goals>
-								<configuration>
-									<additionalparam>-Xdoclint:none</additionalparam>
-								</configuration>
-							</execution>
-						</executions>
-					</plugin>
 					<plugin>
 						<groupId>org.apache.maven.plugins</groupId>
 						<artifactId>maven-gpg-plugin</artifactId>
@@ -129,6 +102,37 @@
 	</profiles>
 	<build>
 		<plugins>
+			<!-- Sources and javadoc attach on every package, not only under -P deploy.
+			     They are what consumers get for IDE source attachment, and the publish
+			     workflow runs a plain `mvn deploy`, so a profile-gated execution never
+			     fired and every published artifact was a bare jar. Both bind to the
+			     package phase, so `mvn test` is unaffected. -->
+			<plugin>
+				<groupId>org.apache.maven.plugins</groupId>
+				<artifactId>maven-source-plugin</artifactId>
+				<version>3.4.0</version>
+				<executions>
+					<execution>
+						<id>attach-sources</id>
+						<goals>
+							<goal>jar</goal>
+						</goals>
+					</execution>
+				</executions>
+			</plugin>
+			<plugin>
+				<groupId>org.apache.maven.plugins</groupId>
+				<artifactId>maven-javadoc-plugin</artifactId>
+				<version>3.12.0</version>
+				<executions>
+					<execution>
+						<id>attach-javadocs</id>
+						<goals>
+							<goal>jar</goal>
+						</goals>
+					</execution>
+				</executions>
+			</plugin>
 			<plugin>
 				<groupId>org.jacoco</groupId>
 				<artifactId>jacoco-maven-plugin</artifactId>