Upgrade dependencies

.github/workflows/broken_links_checker.yml

@@ -13,6 +13,8 @@ jobs:
       contents: read
     steps:
       - uses: actions/checkout@v6
+        with:
+          persist-credentials: false
       - name: Configure broken links checker
         run: |
           mkdir -p ./target

.github/workflows/build.yml

@@ -18,7 +18,7 @@ jobs:
     strategy:
       fail-fast: true
       matrix:
-        java: [17, 21, 24]
+        java: [17, 21, 25]
     name: "Build with Java ${{ matrix.java }}"
     env:
       DEFAULT_JAVA: 17
@@ -27,14 +27,12 @@ jobs:
     - uses: actions/checkout@v6
       with:
         fetch-depth: 0
+        persist-credentials: false
 
     - uses: actions/setup-java@v5
       with:
         distribution: 'temurin'
-        java-version: |
-          17
-          21
-          24
+        java-version: ${{ matrix.java }}
         cache: 'maven'
 
     - name: Cache SonarQube packages
@@ -45,7 +43,7 @@ jobs:
         restore-keys: ${{ runner.os }}-java-${{ matrix.java }}-sonar
 
     - name: Build with Maven
-      run: mvn --errors --batch-mode clean org.jacoco:jacoco-maven-plugin:prepare-agent install -Djava.version=${{ matrix.java }}
+      run: mvn --errors --batch-mode clean org.jacoco:jacoco-maven-plugin:prepare-agent install -DossindexSkip=true -Djava.version=${{ matrix.java }}
 
     - name: Build example projects
       run: |
@@ -73,6 +71,7 @@ jobs:
     - name: Verify reproducible build
       run: |
         mvn --batch-mode clean verify artifact:compare -DskipTests \
+            -DossindexSkip=true \
             -Djava.version=${{ matrix.java }}
 
     - name: Archive aggregated reproducible build report
@@ -84,8 +83,38 @@ jobs:
           target/*.buildinfo
         if-no-files-found: error
 
-  build:
-    needs: matrix-build
+  ossindex:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    steps:
+    - uses: actions/checkout@v6
+      with:
+        persist-credentials: false
+    - uses: actions/setup-java@v5
+      with:
+        cache: maven
+        distribution: temurin
+        java-version: 17
+        server-id: ossindex
+        server-username: OSSINDEX_USERNAME
+        server-password: OSSINDEX_TOKEN
+    - name: Ossindex
+      if: ${{ env.OSSINDEX_USERNAME != null && env.OSSINDEX_TOKEN != null }}
+      run: |
+        mvn --errors --batch-mode test-compile -Djava.version=17 \
+            org.sonatype.ossindex.maven:ossindex-maven-plugin:audit \
+            org.sonatype.ossindex.maven:ossindex-maven-plugin:audit-aggregate
+      env:
+        OSSINDEX_USERNAME: ${{ secrets.OSSINDEX_USERNAME }}
+        OSSINDEX_TOKEN: ${{ secrets.OSSINDEX_TOKEN }}
+
+  build:
+    permissions:
+      contents: read
+    needs:
+      - matrix-build
+      - ossindex
+    runs-on: ubuntu-slim
     steps:
       - run: echo "Build successful"

.github/workflows/codeql-analysis.yml

@@ -20,6 +20,8 @@ jobs:
     steps:
     - name: Checkout repository
       uses: actions/checkout@v6
+      with:
+        persist-credentials: false
 
     - uses: actions/setup-java@v5
       with:
@@ -32,8 +34,9 @@ jobs:
       with:
         languages: java
 
-    - name: Autobuild
-      uses: github/codeql-action/autobuild@v4
+    - name: Build
+      # gitcommitid plugin requires a newer version of maven, so we skip it here
+      run: mvn --batch-mode --errors -Dmaven.gitcommitid.skip=true clean compile
 
     - name: Perform CodeQL Analysis
       uses: github/codeql-action/analyze@v4

.github/workflows/release.yml

@@ -8,6 +8,11 @@ on:
         required: true
         type: boolean
         default: false
+      auto-publish-maven-central:
+        description: "Auto-publish to Maven Central"
+        required: true
+        type: boolean
+        default: true
 
 jobs:
   release:
@@ -23,6 +28,8 @@ jobs:
     steps:
       - name: Checkout
         uses: actions/checkout@v6
+        with:
+          persist-credentials: true
 
       - name: Fail if not running on main branch
         if: ${{ github.ref != 'refs/heads/main' }}
@@ -37,25 +44,30 @@ jobs:
           distribution: "temurin"
           java-version: 17
           cache: "maven"
-          server-id: ossrh
+          server-id: central
           server-username: MAVEN_USERNAME
           server-password: MAVEN_PASSWORD
           gpg-private-key: ${{ secrets.OSSRH_GPG_SECRET_KEY }}
           gpg-passphrase: MAVEN_GPG_PASSPHRASE
 
       - name: Build
-        run: mvn --batch-mode -T 1C clean install
+        run: mvn --batch-mode -DossindexSkip=true clean install
 
       - name: List secret GPG keys
         run: gpg --list-secret-keys
 
       - name: Publish to Maven Central Repository
         if: ${{ !inputs.skip-deploy-maven-central }}
-        run: mvn --batch-mode deploy -Possrh -DstagingDescription="Deployed via GitHub workflow release.yml"
+        run: |
+          mvn --batch-mode deploy -PcentralPublishing -DossindexSkip=true \
+              -DcentralPublishingSkipPublishing=false \
+              -DcentralPublishingAutoPublish=${AUTO_PUBLISH} \
+              -DcentralPublishingDeploymentName="Deploy OFT Maven Plugin via release.yml"
         env:
-          MAVEN_USERNAME: ${{ secrets.OSSRH_USERNAME }}
-          MAVEN_PASSWORD: ${{ secrets.OSSRH_PASSWORD }}
+          MAVEN_USERNAME: ${{ secrets.MAVEN_CENTRAL_PORTAL_USERNAME }}
+          MAVEN_PASSWORD: ${{ secrets.MAVEN_CENTRAL_PORTAL_TOKEN }}
           MAVEN_GPG_PASSPHRASE: ${{ secrets.OSSRH_GPG_SECRET_KEY_PASSWORD }}
+          AUTO_PUBLISH: ${{ inputs.auto-publish-maven-central }}
 
       - name: Create GitHub Release
         run: ./.github/workflows/github_release.sh

.vscode/settings.json

@@ -6,7 +6,6 @@
         "source.generate.finalModifiers": "explicit",
         "source.fixAll": "explicit"
     },
-    "java.saveActions.organizeImports": true,
     "java.sources.organizeImports.starThreshold": 3,
     "java.sources.organizeImports.staticStarThreshold": 3,
     "java.configuration.updateBuildConfiguration": "automatic",

CHANGELOG.md

@@ -4,9 +4,13 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
-## [2.3.1] - Unreleased
+## [2.3.2] - Unreleased
 
-- [#75](https://github.com/itsallcode/openfasttrace-maven-plugin/pull/75) Upgrade dependencies
+## [2.3.1] - 2026-05-18
+
+- [PR #75](https://github.com/itsallcode/openfasttrace-maven-plugin/pull/75) Upgrade dependencies
+- [PR #87](https://github.com/itsallcode/openfasttrace-maven-plugin/pull/87) Upgrade to OFT 4.4.0, upgrade dependencies and Maven Central release process
+- [#85](https://github.com/itsallcode/openfasttrace-maven-plugin/issues/85) Document how to run tracing with custom directories
 
 ## [2.3.0] - 2024-11-13
 

README.md

@@ -34,7 +34,7 @@ Add the openfasttrace-maven-plugin to your `pom.xml`:
 <plugin>
     <groupId>org.itsallcode</groupId>
     <artifactId>openfasttrace-maven-plugin</artifactId>
-    <version>2.3.0</version>
+    <version>2.3.1</version>
     <executions>
         <execution>
             <id>trace-requirements</id>
@@ -69,7 +69,7 @@ You can use OpenFastTrace plugins to import and export requirements in additiona
 <plugin>
     <groupId>org.itsallcode</groupId>
     <artifactId>openfasttrace-maven-plugin</artifactId>
-    <version>2.3.0</version>
+    <version>2.3.1</version>
     <configuration>
         <failBuild>true</failBuild>
     </configuration>
@@ -110,7 +110,7 @@ The following snipped adds source directory `src/main/rust` and test source dire
 <plugin>
     <groupId>org.codehaus.mojo</groupId>
     <artifactId>build-helper-maven-plugin</artifactId>
-    <version>3.6.0</version>
+    <version>3.6.1</version>
     <executions>
         <execution>
             <id>add-source</id>
@@ -140,6 +140,12 @@ The following snipped adds source directory `src/main/rust` and test source dire
 </plugin>
 ```
 
+**Important:** When you add a directory via `build-helper-maven-plugin`, you need to resolve source directories before running OFT. This happens automatically when running `mvn verify`. If you want to run only OFT tracing, you need to do the following:
+
+```sh
+mvn generate-sources openfasttrace:trace
+```
+
 ##### Adding Custom Resource Directories
 
 You can add additional resource directories using the [Maven Resources Plugin](https://maven.apache.org/plugins/maven-resources-plugin/examples/resource-directory.html). The following snipped adds `src/custom-resources` as additional resource directory: