Plugin Details

This report describes goals, parameters details, requirements and sample usage of this plugin.

Goals

Goals available for this plugin:

Goal	Description
ai-build-integrity:clean-artifact-digests	Removes artifact digest files generated by the `generate-artifact-digests` goal. This mojo scans the project's build directory for digest files (sidecar or central) and deletes them. It binds by default to the `clean` phase and runs on each module. Note: Unlike the AI instruction file `HashCleanMojo` which uses `executionRootOnly`, this mojo runs on each module to ensure cleanup of all digest files across the reactor.
ai-build-integrity:clean-hashes	Removes companion hash sidecar files generated by the `generate-hashes` goal. This mojo walks a base directory using NIO `Files.walkFileTree`, finds files matching the configured hash output extension, and deletes them. It binds by default to the `clean` phase, allowing easy cleanup of generated artifacts that live alongside source code (outside the traditional `target` directory).
ai-build-integrity:generate-artifact-digests	Generates cryptographic digest files for build artifacts (JARs, WARs, ZIPs). This mojo scans the project's build directory for artifacts matching the configured include patterns, computes cryptographic digests using streaming hash computation (never loading full artifact files into heap memory), and writes either sidecar digest files or a central ledger. Security rationale: Build artifacts must be hashed at package time so that the verify mojo can detect any tampering before deployment. Performance: Uses 64 KiB streaming hash buffers for low heap pressure even on large JAR/WAR files. Handles multi-module projects efficiently. Algorithm constraints: Supports SHA-256 (default), SHA-384, SHA-512. MD5 and SHA-1 are available via explicit opt-in but emit build warnings as they are compromised.
ai-build-integrity:generate-hashes	Generates companion hash files for AI instruction resources (e.g. AGENTS.md, SKILL.md). This mojo walks a base directory using NIO `Files.walkFileTree`, finds files matching the configured include globs, and writes a companion hash sidecar file alongside each matched file. The hash captures the file content at build time so that the verify mojo can later detect any unauthorized modifications. Security rationale: AI agent instructions must not change after the build begins or after the artifact is shipped. Generating hashes at build time creates a tamper-evident seal on all instruction files. Performance: Uses `Files.walkFileTree` for a single-pass directory traversal with directory pruning, a 64 KiB streaming hash buffer, and a lookup-table hex encoder. Handles both single-module projects and large multi-module projects efficiently.
ai-build-integrity:verify-artifact-digests	Verifies that build artifacts have not been modified since their digests were generated. This mojo reads either sidecar digest files or a central ledger, recomputes the digest of each artifact, and compares against the stored value. If any mismatch is detected and `failOnError` is true, the build fails. Security rationale: Artifact integrity must be verified before deployment to detect any tampering that occurred after packaging. Performance: Uses streaming hash computation with 64 KiB buffers. For large artifact sets, verification adds measurable but acceptable time to the build.
ai-build-integrity:verify-hashes	Verifies that AI instruction resource files have not been modified since their hashes were generated. This mojo finds all companion hash sidecar files under the base directory using NIO `Files.walkFileTree`, recomputes the hash of the corresponding source file, and compares the two. If any mismatch is detected, the build fails with a `org.apache.maven.plugin.MojoExecutionException`. Security rationale: AI agent instructions must not change once a build has begun or after the artifact is shipped. This verification step ensures that no instruction file has been tampered with between the generate phase and the verification phase. Performance: Uses `Files.walkFileTree` for a single-pass directory traversal with directory pruning. Handles both single-module projects and large multi-module projects efficiently.

System Requirements

The following specifies the minimum requirements to run this Maven plugin:

Maven	3.8.0
JDK	1.8

System Requirements History

The following specifies the minimum requirements to run this Maven plugin for historical versions:

Plugin Version	Maven	JDK
0.9.0	3.9.0	11

Usage

You should specify the version in your project's plugin configuration:

<project>
  ...
  <build>
    <!-- To define the plugin version in your parent POM -->
    <pluginManagement>
      <plugins>
        <plugin>
          <groupId>com.intsof</groupId>
          <artifactId>ai-build-integrity-maven-plugin</artifactId>
          <version>0.13.2</version>
        </plugin>
        ...
      </plugins>
    </pluginManagement>
    <!-- To use the plugin goals in your POM or parent POM -->
    <plugins>
      <plugin>
        <groupId>com.intsof</groupId>
        <artifactId>ai-build-integrity-maven-plugin</artifactId>
      </plugin>
      ...
    </plugins>
  </build>
  ...
</project>

For more information, see "Guide to Configuring Plug-ins"