From 45e6cd7c7b238f86278229b30d61b091252051ea Mon Sep 17 00:00:00 2001
From: Shihyu Ho <methodho@gmail.com>
Date: Mon, 20 Jul 2026 17:08:51 +0800
Subject: [PATCH] build: pin boot plugins, drop jar build-info, add maven
 dependabot lane

DEP-03: spring-boot-maven-plugin and native-maven-plugin had no version, so
Maven floated them to the latest release (4.1.0 and 1.1.5) against the 3.5.16
BOM. Pin both via pluginManagement so the tooling tracks the same Boot line as
the BOM. native-maven-plugin is pinned to 0.10.6, the version
spring-boot-dependencies:3.5.16 manages as native-build-tools-plugin.version.

COR-03: drop the build-info execution from mapper/pom.xml. Nothing in the
library reads it, and shipping META-INF/build-info.properties in a library jar
hijacks a consumer's BuildProperties and /actuator/info.

DEP-01: add a maven ecosystem entry to dependabot covering the root and both
module POMs. Spring Boot is ignored there because bump-spring.yml already owns
that lane.

DEP-04 (Boot-line strategy) is a maintainer decision and is not addressed here.

Co-authored-by: Opus 4.8 (1M context) <noreply@softleader.com.tw>
---
 .github/dependabot.yml | 11 +++++++++++
 mapper/pom.xml         |  7 -------
 pom.xml                | 12 ++++++++++++
 3 files changed, 23 insertions(+), 7 deletions(-)

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index f8b99d9e..9b1d85fd 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -6,3 +6,14 @@ updates:
     directory: "/"
     schedule:
       interval: "weekly"
+  - package-ecosystem: "maven"
+    directories:
+      - "/"
+      - "/mapper"
+      - "/starter"
+    schedule:
+      interval: "weekly"
+    ignore:
+      # Spring Boot has its own bump lane (.github/workflows/bump-spring.yml),
+      # which is pinned to the supported line. Leave it to that workflow.
+      - dependency-name: "org.springframework.boot:*"
diff --git a/mapper/pom.xml b/mapper/pom.xml
index 243ec0d1..4eafb35b 100644
--- a/mapper/pom.xml
+++ b/mapper/pom.xml
@@ -81,13 +81,6 @@
       <plugin>
         <groupId>org.springframework.boot</groupId>
         <artifactId>spring-boot-maven-plugin</artifactId>
-        <executions>
-          <execution>
-            <goals>
-              <goal>build-info</goal>
-            </goals>
-          </execution>
-        </executions>
       </plugin>
       <plugin>
         <groupId>com.diffplug.spotless</groupId>
diff --git a/pom.xml b/pom.xml
index 4a1a35f1..3967fcc2 100644
--- a/pom.xml
+++ b/pom.xml
@@ -59,6 +59,8 @@
     <maven-gpg-plugin.version>3.0.1</maven-gpg-plugin.version>
     <jandex-maven-plugin.version>3.4.0</jandex-maven-plugin.version>
     <central-publishing-maven-plugin.version>0.8.0</central-publishing-maven-plugin.version>
+    <!-- Keep in sync with the native-build-tools-plugin.version managed by spring-boot-dependencies:${spring-boot.version} -->
+    <native-maven-plugin.version>0.10.6</native-maven-plugin.version>
 
     <spring-boot.version>3.5.16</spring-boot.version>
     <skip.formatting>false</skip.formatting>
@@ -186,6 +188,16 @@
           <artifactId>maven-surefire-plugin</artifactId>
           <version>${maven-surefire-plugin.version}</version>
         </plugin>
+        <plugin>
+          <groupId>org.springframework.boot</groupId>
+          <artifactId>spring-boot-maven-plugin</artifactId>
+          <version>${spring-boot.version}</version>
+        </plugin>
+        <plugin>
+          <groupId>org.graalvm.buildtools</groupId>
+          <artifactId>native-maven-plugin</artifactId>
+          <version>${native-maven-plugin.version}</version>
+        </plugin>
       </plugins>
     </pluginManagement>
   </build>