Chore: Update Sonar OpenJDK version
[releng/global-jjb.git] / jjb / lf-maven-jobs.yaml
index e42dcde..9a4692c 100644 (file)
@@ -9,7 +9,7 @@
     name: lf-maven-build
     builders:
       - inject:
-          properties-content: 'MAVEN_GOALS={mvn-goals}'
+          properties-content: "MAVEN_GOALS={mvn-goals}"
       - shell: !include-raw-escape:
           - ../shell/common-variables.sh
           - ../shell/maven-build.sh
     builders:
       - conditional-step:
           condition-kind: boolean-expression
-          condition-expression: '{maven-versions-plugin}'
+          condition-expression: "{maven-versions-plugin}"
           steps:
             - inject:
-                properties-file: '{version-properties-file}'
+                properties-file: "{version-properties-file}"
             - maven-target:
-                maven-version: '{mvn-version}'
-                pom: '{mvn-pom}'
-                goals: 'versions:set versions:update-child-modules versions:commit -B'
+                maven-version: "{mvn-version}"
+                pom: "{mvn-pom}"
+                goals: "versions:set versions:update-child-modules versions:commit -B"
                 properties:
-                  - 'newVersion=${{release_version}}'
-                settings: '{mvn-settings}'
+                  - "newVersion=${{release_version}}"
+                settings: "{mvn-settings}"
                 settings-type: cfp
-                global-settings: 'global-settings'
+                global-settings: "global-settings"
                 global-settings-type: cfp
 
 - builder:
     name: lf-maven-stage
     builders:
       - lf-provide-maven-settings:
-          global-settings-file: '{mvn-global-settings}'
-          settings-file: '{mvn-settings}'
+          global-settings-file: "{mvn-global-settings}"
+          settings-file: "{mvn-settings}"
       - lf-infra-create-netrc:
-          server-id: '{mvn-staging-id}'
+          server-id: "{mvn-staging-id}"
       # include-raw-escape fails due to JJB bug
       - shell: !include-raw-escape:
           - ../shell/common-variables.sh
             GIT_URL="$GIT_URL"
       - shell: !include-raw-escape: ../shell/update-java-alternatives.sh
       - inject:
-          properties-file: '/tmp/java.env'
+          properties-file: "/tmp/java.env"
 
 ####################
 # COMMON FUNCTIONS #
 ####################
 
-- lf_maven_common: &lf_maven_common
+- _lf_maven_common: &lf_maven_common
     name: lf-maven-common
 
     ######################
     #####################
 
     project-type: freestyle
-    node: '{build-node}'
+    node: "{build-node}"
 
     properties:
       - lf-infra-properties:
-          build-days-to-keep: '{build-days-to-keep}'
+          build-days-to-keep: "{build-days-to-keep}"
 
     parameters:
       - lf-infra-parameters:
-          project: '{project}'
-          branch: '{branch}'
-          stream: '{stream}'
+          project: "{project}"
+          branch: "{branch}"
+          stream: "{stream}"
       - lf-infra-maven-parameters:
-          mvn-opts: '{mvn-opts}'
-          mvn-params: '{mvn-params}'
-          mvn-version: '{mvn-version}'
+          mvn-opts: "{mvn-opts}"
+          mvn-params: "{mvn-params}"
+          mvn-version: "{mvn-version}"
       - string:
           name: ARCHIVE_ARTIFACTS
-          default: '{archive-artifacts}'
+          default: "{archive-artifacts}"
           description: Artifacts to archive to the logs server.
 
     wrappers:
       - lf-infra-wrappers:
-          build-timeout: '{build-timeout}'
-          jenkins-ssh-credential: '{jenkins-ssh-credential}'
+          build-timeout: "{build-timeout}"
+          jenkins-ssh-credential: "{jenkins-ssh-credential}"
 
     publishers:
       # TODO: Make email notification work.
 # Maven CLM #
 #############
 
-- lf_maven_clm: &lf_maven_clm
+- _lf_maven_clm: &lf_maven_clm
     name: lf-maven-clm
 
     ######################
     ######################
 
     branch: master
-    build-days-to-keep: 30  # 30 days for troubleshooting purposes
+    build-days-to-keep: 30 # 30 days for troubleshooting purposes
     build-timeout: 60
     disable-job: false
-    git-url: '$GIT_URL/$PROJECT'
-    github-url: 'https://github.com'
-    java-version: openjdk8
+    git-url: "$GIT_URL/$PROJECT"
+    github-url: "https://github.com"
+    java-version: openjdk13
     mvn-global-settings: global-settings
-    mvn-opts: ''
-    mvn-params: ''
+    mvn-goals: clean install
+    mvn-opts: ""
+    mvn-params: ""
     mvn-version: mvn35
-    nexus-iq-namespace: ''  # Recommend a trailing dash when set. Example: odl-
-    nexus-iq-stage: 'build'
+    nexus-iq-namespace: "" # Recommend a trailing dash when set. Example: odl-
+    nexus-iq-stage: "build"
     stream: master
     submodule-recursive: true
     submodule-timeout: 10
     submodule-disable: false
 
     nexus_iq_scan_patterns:
-      - '**/*.ear'
-      - '**/*.jar'
-      - '**/*.tar.gz'
-      - '**/*.war'
-      - '**/*.zip'
+      - "**/*.ear"
+      - "**/*.jar"
+      - "**/*.tar.gz"
+      - "**/*.war"
+      - "**/*.zip"
 
     gerrit_clm_triggers:
       - comment-added-contains-event:
 
     parameters:
       - lf-infra-parameters:
-          project: '{project}'
-          branch: '{branch}'
-          stream: '{stream}'
+          project: "{project}"
+          branch: "{branch}"
+          stream: "{stream}"
       - lf-infra-maven-parameters:
-          mvn-opts: '{mvn-opts}'
-          mvn-params: '{mvn-params}'
-          mvn-version: '{mvn-version}'
+          mvn-opts: "{mvn-opts}"
+          mvn-params: "{mvn-params}"
+          mvn-version: "{mvn-version}"
       - string:
           name: ARCHIVE_ARTIFACTS
-          default: '{archive-artifacts}'
+          default: "{archive-artifacts}"
           description: Artifacts to archive to the logs server.
       - lf-clm-parameters:
-          nexus-iq-stage: '{nexus-iq-stage}'
+          nexus-iq-stage: "{nexus-iq-stage}"
 
     #####################
     # Job Configuration #
     #####################
 
-    disabled: '{disable-job}'
+    disabled: "{disable-job}"
 
     builders:
       - lf-infra-pre-build
       - lf-maven-install:
-          mvn-version: '{mvn-version}'
+          mvn-version: "{mvn-version}"
       - lf-update-java-alternatives:
-          java-version: '{java-version}'
+          java-version: "{java-version}"
       - lf-provide-maven-settings:
-          global-settings-file: '{mvn-global-settings}'
-          settings-file: '{mvn-settings}'
-      - shell: !include-raw-escape:
-          - ../shell/common-variables.sh
-          - ../shell/sonatype-clm.sh
+          global-settings-file: "{mvn-global-settings}"
+          settings-file: "{mvn-settings}"
+      - lf-infra-sonatype-clm:
+          mvn-goals: "{mvn-goals}"
       - lf-provide-maven-settings-cleanup
       - shell: 'find . -regex ".*karaf/target" | xargs rm -rf'
       - nexus-iq-policy-evaluator:
-          stage: '{nexus-iq-stage}'
-          application-type: 'manual'
-          application-id: '{nexus-iq-namespace}{project-name}'
-          scan-patterns: '{obj:nexus_iq_scan_patterns}'
+          stage: "{nexus-iq-stage}"
+          application-type: "manual"
+          application-id: "{nexus-iq-namespace}{project-name}"
+          scan-patterns: "{obj:nexus_iq_scan_patterns}"
           fail-build-network-error: true
 
+- builder:
+    name: lf-infra-sonatype-clm
+    # Run a CLM scan build with Maven
+    builders:
+      - inject:
+          properties-content: |
+            MAVEN_GOALS={mvn-goals}
+      - shell: !include-raw-escape:
+          - ../shell/common-variables.sh
+          - ../shell/sonatype-clm.sh
+
 - job-template:
-    name: '{project-name}-maven-clm-{stream}'
+    name: "{project-name}-maven-clm-{stream}"
     id: gerrit-maven-clm
     <<: *lf_maven_common
     # yamllint disable-line rule:key-duplicates
 
     scm:
       - lf-infra-gerrit-scm:
-          jenkins-ssh-credential: '{jenkins-ssh-credential}'
-          git-url: '{git-url}'
-          refspec: '$GERRIT_REFSPEC'
-          branch: '$GERRIT_BRANCH'
-          submodule-recursive: '{submodule-recursive}'
-          submodule-timeout: '{submodule-timeout}'
-          submodule-disable: '{submodule-disable}'
+          jenkins-ssh-credential: "{jenkins-ssh-credential}"
+          git-url: "{git-url}"
+          refspec: "$GERRIT_REFSPEC"
+          branch: "$GERRIT_BRANCH"
+          submodule-recursive: "{submodule-recursive}"
+          submodule-timeout: "{submodule-timeout}"
+          submodule-disable: "{submodule-disable}"
           choosing-strategy: default
 
     triggers:
       # Build weekly on Saturdays
-      - timed: 'H H * * 6'
+      - timed: "H H * * 6"
       - gerrit:
-          server-name: '{gerrit-server-name}'
-          trigger-on: '{obj:gerrit_clm_triggers}'
+          server-name: "{gerrit-server-name}"
+          trigger-on: "{obj:gerrit_clm_triggers}"
           projects:
             - project-compare-type: ANT
-              project-pattern: '{project}'
+              project-pattern: "{project}"
               branches:
                 - branch-compare-type: ANT
-                  branch-pattern: '**/{branch}'
+                  branch-pattern: "**/{branch}"
           skip-vote:
             successful: true
             failed: true
             notbuilt: true
 
 - job-template:
-    name: '{project-name}-maven-clm-{stream}'
+    name: "{project-name}-maven-clm-{stream}"
     id: github-maven-clm
     <<: *lf_maven_common
     # yamllint disable-line rule:key-duplicates
 
     properties:
       - lf-infra-properties:
-          build-days-to-keep: '{build-days-to-keep}'
+          build-days-to-keep: "{build-days-to-keep}"
       - github:
-          url: '{github-url}/{github-org}/{project}'
+          url: "{github-url}/{github-org}/{project}"
 
     scm:
       - lf-infra-github-scm:
-          url: '{git-clone-url}{github-org}/{project}'
-          refspec: ''
-          branch: 'refs/heads/{branch}'
-          submodule-recursive: '{submodule-recursive}'
-          submodule-timeout: '{submodule-timeout}'
-          submodule-disable: '{submodule-disable}'
+          url: "{git-clone-url}{github-org}/{project}"
+          refspec: ""
+          branch: "refs/heads/{branch}"
+          submodule-recursive: "{submodule-recursive}"
+          submodule-timeout: "{submodule-timeout}"
+          submodule-disable: "{submodule-disable}"
           choosing-strategy: default
-          jenkins-ssh-credential: '{jenkins-ssh-credential}'
+          jenkins-ssh-credential: "{jenkins-ssh-credential}"
 
     triggers:
       # Build weekly on Saturdays
-      - timed: 'H H * * 6'
+      - timed: "H H * * 6"
       - github-pull-request:
-          trigger-phrase: '^run-clm$'
+          trigger-phrase: "^run-clm$"
           only-trigger-phrase: true
-          status-context: 'CLM'
+          status-context: "CLM"
           permit-all: true
           github-hooks: true
           org-list:
-            - '{github-org}'
-          white-list: '{obj:github_pr_whitelist}'
-          admin-list: '{obj:github_pr_admin_list}'
+            - "{github-org}"
+          white-list: "{obj:github_pr_allowlist}"
+          admin-list: "{obj:github_pr_admin_list}"
           white-list-target-branches:
-            - '{branch}'
+            - "{branch}"
+
+##################
+# Maven Snyk CLI #
+##################
+
+- _lf_maven_snyk_cli: &lf_maven_snyk_cli
+    name: lf-maven-snyk_cli
+
+    ######################
+    # Default parameters #
+    ######################
+
+    branch: master
+    build-days-to-keep: 30 # 30 days for troubleshooting purposes
+    build-timeout: 60
+    disable-job: false
+    git-url: "$GIT_URL/$PROJECT"
+    github-url: "https://github.com"
+    java-version: openjdk11
+    mvn-global-settings: global-settings
+    mvn-goals: clean install
+    mvn-opts: ""
+    mvn-params: ""
+    mvn-version: mvn35
+    snyk-cli-options: ""
+    snyk-token-credential-id: snyk-token
+    snyk-org-credential-id: snyk-org
+    stream: master
+    submodule-recursive: true
+    submodule-timeout: 10
+    submodule-disable: false
+
+    gerrit_snyk_triggers:
+      - comment-added-contains-event:
+          comment-contains-value: '^Patch Set\s+\d+:\s+run-snyk\s*$'
+
+    parameters:
+      - lf-infra-parameters:
+          project: "{project}"
+          branch: "{branch}"
+          stream: "{stream}"
+      - lf-infra-maven-parameters:
+          mvn-opts: "{mvn-opts}"
+          mvn-params: "{mvn-params}"
+          mvn-version: "{mvn-version}"
+      - string:
+          name: SNYK_CLI_OPTIONS
+          default: "{snyk-cli-options}"
+          description: Additional Snyk CLI commands and options
+      - string:
+          name: ARCHIVE_ARTIFACTS
+          default: "{archive-artifacts}"
+          description: Artifacts to archive to the logs server.
+
+    wrappers:
+      - credentials-binding:
+          - text:
+              credential-id: "{snyk-token-credential-id}"
+              variable: SNYK_TOKEN
+          - text:
+              credential-id: "{snyk-org-credential-id}"
+              variable: SNYK_ORG
+
+    #####################
+    # Job Configuration #
+    #####################
+
+    disabled: "{disable-job}"
+
+    builders:
+      - lf-infra-pre-build
+      - lf-maven-install:
+          mvn-version: "{mvn-version}"
+      - lf-update-java-alternatives:
+          java-version: "{java-version}"
+      - lf-provide-maven-settings:
+          global-settings-file: "{mvn-global-settings}"
+          settings-file: "{mvn-settings}"
+      - lf-maven-build:
+          mvn-goals: "{mvn-goals}"
+      - lf-infra-snyk-cli-scanner
+      - lf-provide-maven-settings-cleanup
+      - shell: 'find . -regex ".*karaf/target" | xargs rm -rf'
+
+- builder:
+    name: lf-infra-snyk-cli-scanner
+    # Download and run the Snyk CLI scanner
+    builders:
+      - shell: !include-raw-escape:
+          - ../shell/snyk-cli-scanner-run.sh
+
+- job-template:
+    name: "{project-name}-maven-snyk-cli-{stream}"
+    id: gerrit-maven-snyk-cli
+    <<: *lf_maven_common
+    # yamllint disable-line rule:key-duplicates
+    <<: *lf_maven_snyk_cli
+
+    scm:
+      - lf-infra-gerrit-scm:
+          jenkins-ssh-credential: "{jenkins-ssh-credential}"
+          git-url: "{git-url}"
+          refspec: "$GERRIT_REFSPEC"
+          branch: "$GERRIT_BRANCH"
+          submodule-recursive: "{submodule-recursive}"
+          submodule-timeout: "{submodule-timeout}"
+          submodule-disable: "{submodule-disable}"
+          choosing-strategy: default
+
+    triggers:
+      # Build weekly on Saturdays
+      - timed: "H H * * 6"
+      - gerrit:
+          server-name: "{gerrit-server-name}"
+          trigger-on: "{obj:gerrit_snyk_triggers}"
+          projects:
+            - project-compare-type: ANT
+              project-pattern: "{project}"
+              branches:
+                - branch-compare-type: ANT
+                  branch-pattern: "**/{branch}"
+          skip-vote:
+            successful: true
+            failed: true
+            unstable: true
+            notbuilt: true
+
+- job-template:
+    name: "{project-name}-maven-snyk-cli-{stream}"
+    id: github-maven-snyk-cli
+    <<: *lf_maven_common
+    # yamllint disable-line rule:key-duplicates
+    <<: *lf_maven_snyk_cli
+
+    properties:
+      - lf-infra-properties:
+          build-days-to-keep: "{build-days-to-keep}"
+      - github:
+          url: "{github-url}/{github-org}/{project}"
+
+    scm:
+      - lf-infra-github-scm:
+          url: "{git-clone-url}{github-org}/{project}"
+          refspec: ""
+          branch: "refs/heads/{branch}"
+          submodule-recursive: "{submodule-recursive}"
+          submodule-timeout: "{submodule-timeout}"
+          submodule-disable: "{submodule-disable}"
+          choosing-strategy: default
+          jenkins-ssh-credential: "{jenkins-ssh-credential}"
+
+    triggers:
+      # Build weekly on Saturdays
+      - timed: "H H * * 6"
+      - github-pull-request:
+          trigger-phrase: "^run-snyk$"
+          only-trigger-phrase: true
+          status-context: "SNYK scan"
+          permit-all: true
+          github-hooks: true
+          org-list:
+            - "{github-org}"
+          white-list: "{obj:github_pr_allowlist}"
+          admin-list: "{obj:github_pr_admin_list}"
+          white-list-target-branches:
+            - "{branch}"
 
 #########################
 # Maven Javadoc Publish #
 #########################
 
-- lf_maven_javadoc_publish: &lf_maven_javadoc_publish
+- _lf_maven_javadoc_publish: &lf_maven_javadoc_publish
     name: lf-maven-javadoc-publish
 
     ######################
     ######################
 
     branch: master
-    build-days-to-keep: 30  # 30 days in case a release takes long to get approved.
+    build-days-to-keep: 30 # 30 days in case a release takes long to get approved.
     build-timeout: 60
     disable-job: false
-    git-url: '$GIT_URL/$PROJECT'
-    github-url: 'https://github.com'
-    java-version: openjdk8
+    git-url: "$GIT_URL/$PROJECT"
+    github-url: "https://github.com"
+    java-version: openjdk11
+    mvn-dir: "."
     mvn-global-settings: global-settings
-    mvn-opts: ''
-    mvn-params: ''
+    mvn-opts: ""
+    mvn-params: ""
     mvn-version: mvn35
     stream: master
     submodule-recursive: true
     # Job Configuration #
     #####################
 
-    disabled: '{disable-job}'
+    disabled: "{disable-job}"
 
     builders:
       - lf-infra-pre-build
       - lf-maven-install:
-          mvn-version: '{mvn-version}'
+          mvn-version: "{mvn-version}"
       - lf-update-java-alternatives:
-          java-version: '{java-version}'
+          java-version: "{java-version}"
       - lf-provide-maven-settings:
-          global-settings-file: '{mvn-global-settings}'
-          settings-file: '{mvn-settings}'
+          global-settings-file: "{mvn-global-settings}"
+          settings-file: "{mvn-settings}"
       - lf-infra-create-netrc:
-          server-id: '{mvn-site-id}'
+          server-id: "{mvn-site-id}"
       - inject:
-          properties-content: 'DEPLOY_PATH={javadoc-path}'
+          properties-content: |
+            DEPLOY_PATH={javadoc-path}
+            MAVEN_DIR={mvn-dir}
       - shell: !include-raw-escape:
           - ../shell/common-variables.sh
           - ../shell/maven-javadoc-generate.sh
       - lf-provide-maven-settings-cleanup
 
 - job-template:
-    name: '{project-name}-maven-javadoc-publish-{stream}-{java-version}'
+    name: "{project-name}-maven-javadoc-publish-{stream}-{java-version}"
     id: gerrit-maven-javadoc-publish
     <<: *lf_maven_common
     # yamllint disable-line rule:key-duplicates
     <<: *lf_maven_javadoc_publish
 
-    git-url: '$GIT_URL/$GERRIT_PROJECT'
+    git-url: "$GIT_URL/$GERRIT_PROJECT"
 
     scm:
       - lf-infra-gerrit-scm:
-          git-url: '{git-url}'
-          refspec: ''
-          branch: '{branch}'
-          submodule-recursive: '{submodule-recursive}'
-          submodule-timeout: '{submodule-timeout}'
-          submodule-disable: '{submodule-disable}'
+          git-url: "{git-url}"
+          refspec: ""
+          branch: "{branch}"
+          submodule-recursive: "{submodule-recursive}"
+          submodule-timeout: "{submodule-timeout}"
+          submodule-disable: "{submodule-disable}"
           choosing-strategy: default
-          jenkins-ssh-credential: '{jenkins-ssh-credential}'
+          jenkins-ssh-credential: "{jenkins-ssh-credential}"
 
     triggers:
       - gerrit:
-          server-name: '{gerrit-server-name}'
-          trigger-on: '{obj:gerrit_merge_triggers}'
+          server-name: "{gerrit-server-name}"
+          trigger-on: "{obj:gerrit_merge_triggers}"
           projects:
             - project-compare-type: ANT
-              project-pattern: '{project}'
+              project-pattern: "{project}"
               branches:
                 - branch-compare-type: ANT
-                  branch-pattern: '**/{branch}'
+                  branch-pattern: "**/{branch}"
 
 - job-template:
-    name: '{project-name}-maven-javadoc-publish-{stream}-{java-version}'
+    name: "{project-name}-maven-javadoc-publish-{stream}-{java-version}"
     id: github-maven-javadoc-publish
     <<: *lf_maven_common
     # yamllint disable-line rule:key-duplicates
 
     properties:
       - lf-infra-properties:
-          build-days-to-keep: '{build-days-to-keep}'
+          build-days-to-keep: "{build-days-to-keep}"
       - github:
-          url: '{github-url}/{github-org}/{project}'
+          url: "{github-url}/{github-org}/{project}"
 
     scm:
       - lf-infra-github-scm:
-          url: '{git-clone-url}{github-org}/{project}'
-          refspec: ''
-          branch: '{branch}'
-          submodule-recursive: '{submodule-recursive}'
-          submodule-timeout: '{submodule-timeout}'
-          submodule-disable: '{submodule-disable}'
+          url: "{git-clone-url}{github-org}/{project}"
+          refspec: ""
+          branch: "{branch}"
+          submodule-recursive: "{submodule-recursive}"
+          submodule-timeout: "{submodule-timeout}"
+          submodule-disable: "{submodule-disable}"
           choosing-strategy: default
-          jenkins-ssh-credential: '{jenkins-ssh-credential}'
+          jenkins-ssh-credential: "{jenkins-ssh-credential}"
 
     triggers:
       - github
       - pollscm:
-          cron: ''
+          cron: ""
       - github-pull-request:
-          trigger-phrase: '^remerge$'
+          trigger-phrase: "^remerge$"
           only-trigger-phrase: true
-          status-context: 'Maven Javadoc Publish'
+          status-context: "Maven Javadoc Publish"
           permit-all: true
           github-hooks: true
           org-list:
-            - '{github-org}'
-          white-list: '{obj:github_pr_whitelist}'
-          admin-list: '{obj:github_pr_admin_list}'
+            - "{github-org}"
+          white-list: "{obj:github_pr_allowlist}"
+          admin-list: "{obj:github_pr_admin_list}"
           white-list-target-branches:
-            - '{branch}'
+            - "{branch}"
 
 ########################
 # Maven Javadoc Verify #
 ########################
 
-- lf_maven_javadoc_verify: &lf_maven_javadoc_verify
+- _lf_maven_javadoc_verify: &lf_maven_javadoc_verify
     name: lf-maven-javadoc-verify
 
     ######################
     ######################
 
     branch: master
-    build-days-to-keep: 30  # 30 days in case a release takes long to get approved.
+    build-days-to-keep: 30 # 30 days in case a release takes long to get approved.
     build-timeout: 60
     disable-job: false
-    git-url: '$GIT_URL/$PROJECT'
-    github-url: 'https://github.com'
-    java-version: openjdk8
+    git-url: "$GIT_URL/$PROJECT"
+    github-url: "https://github.com"
+    java-version: openjdk11
+    mvn-dir: "."
     mvn-global-settings: global-settings
-    mvn-opts: ''
-    mvn-params: ''
+    mvn-opts: ""
+    mvn-params: ""
     mvn-version: mvn35
     stream: master
     submodule-recursive: true
     #####################
 
     concurrent: true
-    disabled: '{disable-job}'
+    disabled: "{disable-job}"
 
     builders:
       - lf-infra-pre-build
       - lf-maven-install:
-          mvn-version: '{mvn-version}'
+          mvn-version: "{mvn-version}"
       - lf-update-java-alternatives:
-          java-version: '{java-version}'
+          java-version: "{java-version}"
       - lf-provide-maven-settings:
-          global-settings-file: '{mvn-global-settings}'
-          settings-file: '{mvn-settings}'
+          global-settings-file: "{mvn-global-settings}"
+          settings-file: "{mvn-settings}"
+      - inject:
+          properties-content: |
+            MAVEN_DIR={mvn-dir}
       - shell: !include-raw-escape:
           - ../shell/common-variables.sh
           - ../shell/maven-javadoc-generate.sh
       - lf-provide-maven-settings-cleanup
 
 - job-template:
-    name: '{project-name}-maven-javadoc-verify-{stream}-{java-version}'
+    name: "{project-name}-maven-javadoc-verify-{stream}-{java-version}"
     id: gerrit-maven-javadoc-verify
     <<: *lf_maven_common
     # yamllint disable-line rule:key-duplicates
 
     scm:
       - lf-infra-gerrit-scm:
-          jenkins-ssh-credential: '{jenkins-ssh-credential}'
-          git-url: '{git-url}'
-          refspec: '$GERRIT_REFSPEC'
-          branch: '$GERRIT_BRANCH'
-          submodule-recursive: '{submodule-recursive}'
-          submodule-timeout: '{submodule-timeout}'
-          submodule-disable: '{submodule-disable}'
+          jenkins-ssh-credential: "{jenkins-ssh-credential}"
+          git-url: "{git-url}"
+          refspec: "$GERRIT_REFSPEC"
+          branch: "$GERRIT_BRANCH"
+          submodule-recursive: "{submodule-recursive}"
+          submodule-timeout: "{submodule-timeout}"
+          submodule-disable: "{submodule-disable}"
           choosing-strategy: gerrit
 
     triggers:
       - gerrit:
-          server-name: '{gerrit-server-name}'
-          trigger-on: '{obj:gerrit_verify_triggers}'
+          server-name: "{gerrit-server-name}"
+          trigger-on: "{obj:gerrit_verify_triggers}"
           projects:
             - project-compare-type: ANT
-              project-pattern: '{project}'
+              project-pattern: "{project}"
               branches:
                 - branch-compare-type: ANT
-                  branch-pattern: '**/{branch}'
+                  branch-pattern: "**/{branch}"
 
 - job-template:
-    name: '{project-name}-maven-javadoc-verify-{stream}-{java-version}'
+    name: "{project-name}-maven-javadoc-verify-{stream}-{java-version}"
     id: github-maven-javadoc-verify
     <<: *lf_maven_common
     # yamllint disable-line rule:key-duplicates
 
     properties:
       - lf-infra-properties:
-          build-days-to-keep: '{build-days-to-keep}'
+          build-days-to-keep: "{build-days-to-keep}"
       - github:
-          url: '{github-url}/{github-org}/{project}'
+          url: "{github-url}/{github-org}/{project}"
 
     scm:
       - lf-infra-github-scm:
-          url: '{git-clone-url}{github-org}/{project}'
-          refspec: '+refs/pull/*:refs/remotes/origin/pr/*'
-          branch: '$sha1'
-          submodule-recursive: '{submodule-recursive}'
-          submodule-timeout: '{submodule-timeout}'
-          submodule-disable: '{submodule-disable}'
+          url: "{git-clone-url}{github-org}/{project}"
+          refspec: "+refs/pull/*:refs/remotes/origin/pr/*"
+          branch: "$sha1"
+          submodule-recursive: "{submodule-recursive}"
+          submodule-timeout: "{submodule-timeout}"
+          submodule-disable: "{submodule-disable}"
           choosing-strategy: default
-          jenkins-ssh-credential: '{jenkins-ssh-credential}'
+          jenkins-ssh-credential: "{jenkins-ssh-credential}"
 
     triggers:
       - github-pull-request:
           trigger-phrase: ^(recheck|reverify)$
           only-trigger-phrase: false
-          status-context: 'Maven Javadoc Verify'
+          status-context: "Maven Javadoc Verify"
           permit-all: true
           github-hooks: true
           white-list-target-branches:
-            - '{branch}'
+            - "{branch}"
 
 ###############
 # Maven Merge #
 ###############
 
-- lf_maven_merge: &lf_maven_merge
+- _lf_maven_merge: &lf_maven_merge
     name: lf-maven-merge
 
     ######################
     ######################
 
     branch: master
-    build-days-to-keep: 30  # 30 days in case we need to troubleshoot
+    build-days-to-keep: 30 # 30 days in case we need to troubleshoot
     build-timeout: 60
-    cron: '@daily'
+    cron: "@daily"
     disable-job: false
-    git-url: '$GIT_URL/$PROJECT'
-    github-url: 'https://github.com'
-    java-version: openjdk8
+    git-url: "$GIT_URL/$PROJECT"
+    github-url: "https://github.com"
+    jacoco-exclude-pattern: "**/gen/**,**/generated-sources/**,**/yang-gen**,**/pax/**"
+    java-version: openjdk11
     mvn-global-settings: global-settings
     mvn-goals: clean deploy
-    mvn-opts: ''
-    mvn-params: '-Dmerge'
+    mvn-opts: ""
+    mvn-params: "-Dmerge"
     mvn-version: mvn35
-    nexus-cut-dirs: 6  # Number of dirs in the Nexus path to remove for wget -r.
+    nexus-cut-dirs: 6 # Number of dirs in the Nexus path to remove for wget -r.
+    pre-build-script: "# pre-build script goes here"
+    post-build-script: "# post-build script goes here"
     stream: master
     submodule-recursive: true
     submodule-timeout: 10
 
     gerrit_trigger_file_paths:
       - compare-type: REG_EXP
-        pattern: '.*'
+        pattern: ".*"
 
     # github_included_regions MUST match gerrit_trigger_file_paths
     github_included_regions:
-      - '.*'
+      - ".*"
 
-    post_build_trigger: ''
+    post_build_trigger: ""
 
     #####################
     # Job Configuration #
     #####################
 
-    disabled: '{disable-job}'
+    disabled: "{disable-job}"
 
     builders:
       - lf-infra-pre-build
       - lf-jacoco-nojava-workaround
       - lf-maven-install:
-          mvn-version: '{mvn-version}'
+          mvn-version: "{mvn-version}"
       - lf-update-java-alternatives:
-          java-version: '{java-version}'
+          java-version: "{java-version}"
       - lf-provide-maven-settings:
-          global-settings-file: '{mvn-global-settings}'
-          settings-file: '{mvn-settings}'
+          global-settings-file: "{mvn-global-settings}"
+          settings-file: "{mvn-settings}"
       - lf-infra-create-netrc:
-          server-id: '{mvn-snapshot-id}'
+          server-id: "{mvn-snapshot-id}"
       - inject:
           properties-content: |
-              NEXUS_CUT_DIRS={nexus-cut-dirs}
-              NEXUS_REPO={nexus-snapshot-repo}
+            NEXUS_CUT_DIRS={nexus-cut-dirs}
+            NEXUS_REPO={nexus-snapshot-repo}
       - shell: !include-raw-escape: ../shell/maven-fetch-metadata.sh
+      - shell: "{pre-build-script}"
       - lf-maven-build:
-          mvn-goals: '{mvn-goals}'
+          mvn-goals: "{mvn-goals}"
+      - shell: "{post-build-script}"
       - lf-maven-deploy
       - lf-provide-maven-settings-cleanup
 
     publishers:
       - findbugs
-      - lf-jacoco-report
+      - lf-jacoco-report:
+          exclude-pattern: "{jacoco-exclude-pattern}"
       - lf-infra-publish
-      - trigger-parameterized-builds: '{obj:post_build_trigger}'
+      - trigger-parameterized-builds: "{obj:post_build_trigger}"
 
 - job-template:
-    name: '{project-name}-maven-merge-{stream}'
+    name: "{project-name}-maven-merge-{stream}"
     id: gerrit-maven-merge
     <<: *lf_maven_common
     # yamllint disable-line rule:key-duplicates
 
     scm:
       - lf-infra-gerrit-scm:
-          jenkins-ssh-credential: '{jenkins-ssh-credential}'
-          git-url: '{git-url}'
-          refspec: '$GERRIT_REFSPEC'
-          branch: '$GERRIT_BRANCH'
-          submodule-recursive: '{submodule-recursive}'
-          submodule-timeout: '{submodule-timeout}'
-          submodule-disable: '{submodule-disable}'
+          jenkins-ssh-credential: "{jenkins-ssh-credential}"
+          git-url: "{git-url}"
+          refspec: "$GERRIT_REFSPEC"
+          branch: "$GERRIT_BRANCH"
+          submodule-recursive: "{submodule-recursive}"
+          submodule-timeout: "{submodule-timeout}"
+          submodule-disable: "{submodule-disable}"
           choosing-strategy: default
 
     triggers:
-      - timed: '{obj:cron}'
+      - timed: "{obj:cron}"
       - gerrit:
-          server-name: '{gerrit-server-name}'
-          trigger-on: '{obj:gerrit_merge_triggers}'
+          server-name: "{gerrit-server-name}"
+          trigger-on: "{obj:gerrit_merge_triggers}"
           projects:
             - project-compare-type: ANT
-              project-pattern: '{project}'
+              project-pattern: "{project}"
               branches:
                 - branch-compare-type: ANT
-                  branch-pattern: '**/{branch}'
-              file-paths: '{obj:gerrit_trigger_file_paths}'
+                  branch-pattern: "**/{branch}"
+              file-paths: "{obj:gerrit_trigger_file_paths}"
 
 - job-template:
-    name: '{project-name}-maven-merge-{stream}'
+    name: "{project-name}-maven-merge-{stream}"
     id: github-maven-merge
     <<: *lf_maven_common
     # yamllint disable-line rule:key-duplicates
 
     properties:
       - lf-infra-properties:
-          build-days-to-keep: '{build-days-to-keep}'
+          build-days-to-keep: "{build-days-to-keep}"
       - github:
-          url: '{github-url}/{github-org}/{project}'
+          url: "{github-url}/{github-org}/{project}"
 
     scm:
       - lf-infra-github-scm:
-          url: '{git-clone-url}{github-org}/{project}'
-          refspec: ''
-          branch: 'refs/heads/{branch}'
-          submodule-recursive: '{submodule-recursive}'
-          submodule-timeout: '{submodule-timeout}'
-          submodule-disable: '{submodule-disable}'
+          url: "{git-clone-url}{github-org}/{project}"
+          refspec: ""
+          branch: "refs/heads/{branch}"
+          submodule-recursive: "{submodule-recursive}"
+          submodule-timeout: "{submodule-timeout}"
+          submodule-disable: "{submodule-disable}"
           choosing-strategy: default
-          jenkins-ssh-credential: '{jenkins-ssh-credential}'
+          jenkins-ssh-credential: "{jenkins-ssh-credential}"
 
     triggers:
-      - timed: '{obj:cron}'
+      - timed: "{obj:cron}"
       - github
       - pollscm:
-          cron: ''
+          cron: ""
       - github-pull-request:
-          trigger-phrase: '^remerge$'
+          trigger-phrase: "^remerge$"
           only-trigger-phrase: true
-          status-context: 'Maven Merge'
+          status-context: "Maven Merge"
           permit-all: true
           github-hooks: true
           org-list:
-            - '{github-org}'
-          white-list: '{obj:github_pr_whitelist}'
-          admin-list: '{obj:github_pr_admin_list}'
+            - "{github-org}"
+          white-list: "{obj:github_pr_allowlist}"
+          admin-list: "{obj:github_pr_admin_list}"
           white-list-target-branches:
-            - '{branch}'
-          included-regions: '{obj:github_included_regions}'
+            - "{branch}"
+          included-regions: "{obj:github_included_regions}"
 
 ##########################
 # Maven Merge for Docker #
 ##########################
 
-- lf_maven_docker_merge: &lf_maven_docker_merge
+- _lf_maven_docker_merge: &lf_maven_docker_merge
     name: lf-maven-docker-merge
 
     builders:
       - lf-infra-pre-build
       - lf-jacoco-nojava-workaround
       - lf-maven-install:
-          mvn-version: '{mvn-version}'
+          mvn-version: "{mvn-version}"
       - lf-infra-docker-login:
-          global-settings-file: '{mvn-global-settings}'
-          settings-file: '{mvn-settings}'
+          global-settings-file: "{mvn-global-settings}"
+          settings-file: "{mvn-settings}"
       - lf-update-java-alternatives:
-          java-version: '{java-version}'
+          java-version: "{java-version}"
       # must provide maven settings AFTER docker due to its cleanup
       - lf-provide-maven-settings:
-          global-settings-file: '{mvn-global-settings}'
-          settings-file: '{mvn-settings}'
+          global-settings-file: "{mvn-global-settings}"
+          settings-file: "{mvn-settings}"
       - lf-infra-create-netrc:
-          server-id: '{mvn-snapshot-id}'
+          server-id: "{mvn-snapshot-id}"
       - inject:
           properties-content: |
-              NEXUS_CUT_DIRS={nexus-cut-dirs}
-              NEXUS_REPO={nexus-snapshot-repo}
-              CONTAINER_PULL_REGISTRY={container-public-registry}
-              CONTAINER_PUSH_REGISTRY={container-snapshot-registry}
+            NEXUS_CUT_DIRS={nexus-cut-dirs}
+            NEXUS_REPO={nexus-snapshot-repo}
+            CONTAINER_PULL_REGISTRY={container-public-registry}
+            CONTAINER_PUSH_REGISTRY={container-snapshot-registry}
       - shell: !include-raw-escape: ../shell/maven-fetch-metadata.sh
       - lf-maven-build:
-          mvn-goals: '{mvn-goals}'
+          mvn-goals: "{mvn-goals}"
       # NO lf-maven-deploy
       - lf-provide-maven-settings-cleanup
 
 - job-template:
-    name: '{project-name}-maven-docker-merge-{stream}'
+    name: "{project-name}-maven-docker-merge-{stream}"
     id: gerrit-maven-docker-merge
     <<: *lf_maven_common
     # yamllint disable-line rule:key-duplicates
 
     scm:
       - lf-infra-gerrit-scm:
-          jenkins-ssh-credential: '{jenkins-ssh-credential}'
-          git-url: '{git-url}'
-          refspec: '$GERRIT_REFSPEC'
-          branch: '$GERRIT_BRANCH'
-          submodule-recursive: '{submodule-recursive}'
-          submodule-timeout: '{submodule-timeout}'
-          submodule-disable: '{submodule-disable}'
+          jenkins-ssh-credential: "{jenkins-ssh-credential}"
+          git-url: "{git-url}"
+          refspec: "$GERRIT_REFSPEC"
+          branch: "$GERRIT_BRANCH"
+          submodule-recursive: "{submodule-recursive}"
+          submodule-timeout: "{submodule-timeout}"
+          submodule-disable: "{submodule-disable}"
           choosing-strategy: default
 
     triggers:
       - gerrit:
-          server-name: '{gerrit-server-name}'
-          trigger-on: '{obj:gerrit_merge_triggers}'
+          server-name: "{gerrit-server-name}"
+          trigger-on: "{obj:gerrit_merge_triggers}"
           projects:
             - project-compare-type: ANT
-              project-pattern: '{project}'
+              project-pattern: "{project}"
               branches:
                 - branch-compare-type: ANT
-                  branch-pattern: '**/{branch}'
-              file-paths: '{obj:gerrit_trigger_file_paths}'
+                  branch-pattern: "**/{branch}"
+              file-paths: "{obj:gerrit_trigger_file_paths}"
 
 - job-template:
-    name: '{project-name}-maven-docker-merge-{stream}'
+    name: "{project-name}-maven-docker-merge-{stream}"
     id: github-maven-docker-merge
     <<: *lf_maven_common
     # yamllint disable-line rule:key-duplicates
 
     properties:
       - lf-infra-properties:
-          build-days-to-keep: '{build-days-to-keep}'
+          build-days-to-keep: "{build-days-to-keep}"
       - github:
-          url: '{github-url}/{github-org}/{project}'
+          url: "{github-url}/{github-org}/{project}"
 
     scm:
       - lf-infra-github-scm:
-          url: '{git-clone-url}{github-org}/{project}'
-          refspec: ''
-          branch: 'refs/heads/{branch}'
-          submodule-recursive: '{submodule-recursive}'
-          submodule-timeout: '{submodule-timeout}'
-          submodule-disable: '{submodule-disable}'
+          url: "{git-clone-url}{github-org}/{project}"
+          refspec: ""
+          branch: "refs/heads/{branch}"
+          submodule-recursive: "{submodule-recursive}"
+          submodule-timeout: "{submodule-timeout}"
+          submodule-disable: "{submodule-disable}"
           choosing-strategy: default
-          jenkins-ssh-credential: '{jenkins-ssh-credential}'
+          jenkins-ssh-credential: "{jenkins-ssh-credential}"
 
     triggers:
       - github
       - pollscm:
-          cron: ''
+          cron: ""
       - github-pull-request:
-          trigger-phrase: '^remerge$'
+          trigger-phrase: "^remerge$"
           only-trigger-phrase: true
-          status-context: 'Maven Docker Merge'
+          status-context: "Maven Docker Merge"
           permit-all: true
           github-hooks: true
           org-list:
-            - '{github-org}'
-          white-list: '{obj:github_pr_whitelist}'
-          admin-list: '{obj:github_pr_admin_list}'
+            - "{github-org}"
+          white-list: "{obj:github_pr_allowlist}"
+          admin-list: "{obj:github_pr_admin_list}"
           white-list-target-branches:
-            - '{branch}'
-          included-regions: '{obj:github_included_regions}'
+            - "{branch}"
+          included-regions: "{obj:github_included_regions}"
 
 ###############
 # Maven Stage #
 ###############
 
-- lf_maven_stage: &lf_maven_stage
+- _lf_maven_stage: &lf_maven_stage
     name: lf-maven-stage
 
     ######################
     ######################
 
     branch: master
-    build-days-to-keep: 30  # 30 days in case a release takes long to get approved.
+    build-days-to-keep: 30 # 30 days in case a release takes long to get approved.
     build-timeout: 60
-    cron: '@daily'
+    cron: ""
     disable-job: false
-    git-url: '$GIT_URL/$PROJECT'
-    github-url: 'https://github.com'
-    java-version: openjdk8
+    git-url: "$GIT_URL/$PROJECT"
+    github-url: "https://github.com"
+    java-version: openjdk11
     maven-versions-plugin: false
     version-properties-file: version.properties
     mvn-central: false
     mvn-global-settings: global-settings
     mvn-goals: clean deploy
-    mvn-opts: ''
-    mvn-params: ''
+    mvn-opts: ""
+    mvn-params: ""
     mvn-version: mvn35
-    ossrh-profile-id: ''
-    mvn-pom: ''
+    ossrh-profile-id: ""
+    mvn-pom: ""
+    sbom-flags: ""
+    sbom-path: "$WORKSPACE"
+    sbom-generator: false
+    sbom-generator-version: "v0.0.15"
     sign-artifacts: false
     sign-mode: serial
     stream: master
 
     gerrit_release_triggers:
       - comment-added-contains-event:
-          comment-contains-value: '^Patch Set\s+\d+:\s+stage-release\s*$'
+          comment-contains-value: '^Patch Set\s+\d+:\s+stage-(maven-)?release\s*$'
 
     gerrit_trigger_file_paths:
       - compare-type: ANT
-        pattern: '**'
+        pattern: "**"
 
     # github_included_regions MUST match gerrit_trigger_file_paths
     github_included_regions:
-      - '.*'
+      - ".*"
 
     #####################
     # Job Configuration #
     #####################
 
-    disabled: '{disable-job}'
+    disabled: "{disable-job}"
 
     parameters:
       - lf-infra-parameters:
-          project: '{project}'
-          branch: '{branch}'
-          stream: '{stream}'
+          project: "{project}"
+          branch: "{branch}"
+          stream: "{stream}"
       - lf-infra-maven-parameters:
-          mvn-opts: '{mvn-opts}'
-          mvn-params: '{mvn-params}'
-          mvn-version: '{mvn-version}'
-          staging-profile-id: '{staging-profile-id}'
+          mvn-opts: "{mvn-opts}"
+          mvn-params: "{mvn-params}"
+          mvn-version: "{mvn-version}"
+          staging-profile-id: "{staging-profile-id}"
       - bool:
           name: MAVEN_VERSIONS_PLUGIN
-          default: '{maven-versions-plugin}'
+          default: "{maven-versions-plugin}"
           description: Use maven-versions-plugin to update pom versions.
       - string:
           name: ARCHIVE_ARTIFACTS
-          default: '{archive-artifacts}'
+          default: "{archive-artifacts}"
           description: Artifacts to archive to the logs server.
       - string:
           name: STAGING_PROFILE_ID
-          default: '{staging-profile-id}'
+          default: "{staging-profile-id}"
           description: Nexus staging profile ID.
+      - string:
+          name: SBOM_GENERATOR_VERSION
+          default: "{sbom-generator-version}"
+          description: SBOM generator version to download and run.
+      - string:
+          name: SBOM_PATH
+          default: "{sbom-path}"
+          description: path where SBOM needs to be executed.
 
     builders:
       - lf-infra-pre-build
       - lf-jacoco-nojava-workaround
       - lf-maven-install:
-          mvn-version: '{mvn-version}'
+          mvn-version: "{mvn-version}"
       - lf-update-java-alternatives:
-          java-version: '{java-version}'
+          java-version: "{java-version}"
       - lf-provide-maven-settings:
-          global-settings-file: '{mvn-global-settings}'
-          settings-file: '{mvn-settings}'
+          global-settings-file: "{mvn-global-settings}"
+          settings-file: "{mvn-settings}"
       - lf-maven-versions-plugin:
-          maven-versions-plugin: '{maven-versions-plugin}'
-          version-properties-file: '{version-properties-file}'
-          mvn-version: '{mvn-version}'
-          mvn-pom: '{mvn-pom}'
-          mvn-settings: '{mvn-settings}'
+          maven-versions-plugin: "{maven-versions-plugin}"
+          version-properties-file: "{version-properties-file}"
+          mvn-version: "{mvn-version}"
+          mvn-pom: "{mvn-pom}"
+          mvn-settings: "{mvn-settings}"
       - shell: !include-raw-escape: ../shell/maven-patch-release.sh
       - lf-maven-build:
-          mvn-goals: '{mvn-goals}'
+          mvn-goals: "{mvn-goals}"
+      # With SBOM Generator
+      - conditional-step:
+          condition-kind: boolean-expression
+          condition-expression: "{sbom-generator}"
+          steps:
+            - shell: echo 'Running SBOM Generator'
+            - lf-infra-maven-sbom-generator:
+                sbom-flags: "{sbom-flags}"
       - lf-sigul-sign-dir:
-          sign-artifacts: '{sign-artifacts}'
-          sign-dir: '$WORKSPACE/m2repo'
-          sign-mode: '{sign-mode}'
+          sign-artifacts: "{sign-artifacts}"
+          sign-dir: "$WORKSPACE/m2repo"
+          sign-mode: "{sign-mode}"
       - lf-maven-stage:
-          mvn-global-settings: '{mvn-global-settings}'
-          mvn-settings: '{mvn-settings}'
-          mvn-staging-id: '{mvn-staging-id}'
+          mvn-global-settings: "{mvn-global-settings}"
+          mvn-settings: "{mvn-settings}"
+          mvn-staging-id: "{mvn-staging-id}"
       - lf-maven-central:
-          mvn-central: '{mvn-central}'
-          mvn-global-settings: '{mvn-global-settings}'
-          mvn-settings: '{mvn-settings}'
-          ossrh-profile-id: '{ossrh-profile-id}'
+          mvn-central: "{mvn-central}"
+          mvn-global-settings: "{mvn-global-settings}"
+          mvn-settings: "{mvn-settings}"
+          ossrh-profile-id: "{ossrh-profile-id}"
       - lf-provide-maven-settings-cleanup
 
 - job-template:
-    name: '{project-name}-maven-stage-{stream}'
+    name: "{project-name}-maven-stage-{stream}"
     id: gerrit-maven-stage
     <<: *lf_maven_common
     # yamllint disable-line rule:key-duplicates
 
     scm:
       - lf-infra-gerrit-scm:
-          jenkins-ssh-credential: '{jenkins-ssh-credential}'
-          git-url: '{git-url}'
-          refspec: '$GERRIT_REFSPEC'
-          branch: '$GERRIT_BRANCH'
-          submodule-recursive: '{submodule-recursive}'
-          submodule-timeout: '{submodule-timeout}'
-          submodule-disable: '{submodule-disable}'
+          jenkins-ssh-credential: "{jenkins-ssh-credential}"
+          git-url: "{git-url}"
+          refspec: "$GERRIT_REFSPEC"
+          branch: "$GERRIT_BRANCH"
+          submodule-recursive: "{submodule-recursive}"
+          submodule-timeout: "{submodule-timeout}"
+          submodule-disable: "{submodule-disable}"
           choosing-strategy: default
 
     triggers:
-      - timed: '{obj:cron}'
+      - timed: "{obj:cron}"
       - gerrit:
-          server-name: '{gerrit-server-name}'
-          trigger-on: '{obj:gerrit_release_triggers}'
+          server-name: "{gerrit-server-name}"
+          trigger-on: "{obj:gerrit_release_triggers}"
           projects:
             - project-compare-type: ANT
-              project-pattern: '{project}'
+              project-pattern: "{project}"
               branches:
                 - branch-compare-type: ANT
-                  branch-pattern: '**/{branch}'
-              file-paths: '{obj:gerrit_trigger_file_paths}'
+                  branch-pattern: "**/{branch}"
+              file-paths: "{obj:gerrit_trigger_file_paths}"
 
 - job-template:
-    name: '{project-name}-maven-stage-{stream}'
+    name: "{project-name}-maven-stage-{stream}"
     id: github-maven-stage
     <<: *lf_maven_common
     # yamllint disable-line rule:key-duplicates
 
     properties:
       - lf-infra-properties:
-          build-days-to-keep: '{build-days-to-keep}'
+          build-days-to-keep: "{build-days-to-keep}"
       - github:
-          url: '{github-url}/{github-org}/{project}'
+          url: "{github-url}/{github-org}/{project}"
 
     scm:
       - lf-infra-github-scm:
-          url: '{git-clone-url}{github-org}/{project}'
-          refspec: '+refs/pull/*:refs/remotes/origin/pr/*'
-          branch: '{branch}'
-          submodule-recursive: '{submodule-recursive}'
-          submodule-timeout: '{submodule-timeout}'
-          submodule-disable: '{submodule-disable}'
+          url: "{git-clone-url}{github-org}/{project}"
+          refspec: "+refs/pull/*:refs/remotes/origin/pr/*"
+          branch: "{branch}"
+          submodule-recursive: "{submodule-recursive}"
+          submodule-timeout: "{submodule-timeout}"
+          submodule-disable: "{submodule-disable}"
           choosing-strategy: default
-          jenkins-ssh-credential: '{jenkins-ssh-credential}'
+          jenkins-ssh-credential: "{jenkins-ssh-credential}"
 
     triggers:
-      - timed: '{obj:cron}'
+      - timed: "{obj:cron}"
       - github-pull-request:
-          trigger-phrase: '^build release$'
+          trigger-phrase: "^stage-(maven-)?release$"
           only-trigger-phrase: true
-          status-context: 'Maven Release'
+          status-context: "Maven Release"
           permit-all: true
           github-hooks: true
           white-list-target-branches:
-            - '{branch}'
-          included-regions: '{obj:github_included_regions}'
+            - "{branch}"
+          included-regions: "{obj:github_included_regions}"
 
 ##########################
 # Maven Stage for Docker #
 ##########################
 
-- lf_maven_docker_stage: &lf_maven_docker_stage
+- _lf_maven_docker_stage: &lf_maven_docker_stage
     name: lf-maven-docker-stage
 
     builders:
       - lf-infra-pre-build
       - lf-jacoco-nojava-workaround
       - lf-maven-install:
-          mvn-version: '{mvn-version}'
+          mvn-version: "{mvn-version}"
       - lf-update-java-alternatives:
-          java-version: '{java-version}'
+          java-version: "{java-version}"
       - lf-infra-docker-login:
-          global-settings-file: '{mvn-global-settings}'
-          settings-file: '{mvn-settings}'
+          global-settings-file: "{mvn-global-settings}"
+          settings-file: "{mvn-settings}"
       # must provide maven settings AFTER docker-login due to its cleanup
       - lf-provide-maven-settings:
-          global-settings-file: '{mvn-global-settings}'
-          settings-file: '{mvn-settings}'
+          global-settings-file: "{mvn-global-settings}"
+          settings-file: "{mvn-settings}"
       - lf-maven-versions-plugin:
-          maven-versions-plugin: '{maven-versions-plugin}'
-          version-properties-file: '{version-properties-file}'
-          mvn-version: '{mvn-version}'
-          mvn-pom: '{mvn-pom}'
-          mvn-settings: '{mvn-settings}'
+          maven-versions-plugin: "{maven-versions-plugin}"
+          version-properties-file: "{version-properties-file}"
+          mvn-version: "{mvn-version}"
+          mvn-pom: "{mvn-pom}"
+          mvn-settings: "{mvn-settings}"
       - shell: !include-raw-escape: ../shell/maven-patch-release.sh
       - inject:
           properties-content: |
-              CONTAINER_PULL_REGISTRY={container-public-registry}
-              CONTAINER_PUSH_REGISTRY={container-staging-registry}
+            CONTAINER_PULL_REGISTRY={container-public-registry}
+            CONTAINER_PUSH_REGISTRY={container-staging-registry}
       - lf-maven-build:
-          mvn-goals: '{mvn-goals}'
+          mvn-goals: "{mvn-goals}"
       - lf-sigul-sign-dir:
-          sign-artifacts: '{sign-artifacts}'
-          sign-dir: '$WORKSPACE/m2repo'
-          sign-mode: '{sign-mode}'
+          sign-artifacts: "{sign-artifacts}"
+          sign-dir: "$WORKSPACE/m2repo"
+          sign-mode: "{sign-mode}"
       # NO lf-maven-stage
       # NO lf-maven-central
       - lf-provide-maven-settings-cleanup
 
+    gerrit_release_docker_triggers:
+      - comment-added-contains-event:
+          comment-contains-value: '^Patch Set\s+\d+:\s+stage-(docker-)?release\s*$'
+
 - job-template:
-    name: '{project-name}-maven-docker-stage-{stream}'
+    name: "{project-name}-maven-docker-stage-{stream}"
     id: gerrit-maven-docker-stage
     <<: *lf_maven_common
     # yamllint disable-line rule:key-duplicates
 
     scm:
       - lf-infra-gerrit-scm:
-          jenkins-ssh-credential: '{jenkins-ssh-credential}'
-          git-url: '{git-url}'
-          refspec: '$GERRIT_REFSPEC'
-          branch: '$GERRIT_BRANCH'
-          submodule-recursive: '{submodule-recursive}'
-          submodule-timeout: '{submodule-timeout}'
-          submodule-disable: '{submodule-disable}'
+          jenkins-ssh-credential: "{jenkins-ssh-credential}"
+          git-url: "{git-url}"
+          refspec: "$GERRIT_REFSPEC"
+          branch: "$GERRIT_BRANCH"
+          submodule-recursive: "{submodule-recursive}"
+          submodule-timeout: "{submodule-timeout}"
+          submodule-disable: "{submodule-disable}"
           choosing-strategy: default
 
     triggers:
-      - timed: '{obj:cron}'
+      - timed: "{obj:cron}"
       - gerrit:
-          server-name: '{gerrit-server-name}'
-          trigger-on: '{obj:gerrit_release_triggers}'
+          server-name: "{gerrit-server-name}"
+          trigger-on: "{obj:gerrit_release_docker_triggers}"
           projects:
             - project-compare-type: ANT
-              project-pattern: '{project}'
+              project-pattern: "{project}"
               branches:
                 - branch-compare-type: ANT
-                  branch-pattern: '**/{branch}'
-              file-paths: '{obj:gerrit_trigger_file_paths}'
+                  branch-pattern: "**/{branch}"
+              file-paths: "{obj:gerrit_trigger_file_paths}"
 
 - job-template:
-    name: '{project-name}-maven-docker-stage-{stream}'
+    name: "{project-name}-maven-docker-stage-{stream}"
     id: github-maven-docker-stage
     <<: *lf_maven_common
     # yamllint disable-line rule:key-duplicates
 
     properties:
       - lf-infra-properties:
-          build-days-to-keep: '{build-days-to-keep}'
+          build-days-to-keep: "{build-days-to-keep}"
       - github:
-          url: '{github-url}/{github-org}/{project}'
+          url: "{github-url}/{github-org}/{project}"
 
     scm:
       - lf-infra-github-scm:
-          url: '{git-clone-url}{github-org}/{project}'
-          refspec: '+refs/pull/*:refs/remotes/origin/pr/*'
-          branch: '{branch}'
-          submodule-recursive: '{submodule-recursive}'
-          submodule-timeout: '{submodule-timeout}'
-          submodule-disable: '{submodule-disable}'
+          url: "{git-clone-url}{github-org}/{project}"
+          refspec: "+refs/pull/*:refs/remotes/origin/pr/*"
+          branch: "{branch}"
+          submodule-recursive: "{submodule-recursive}"
+          submodule-timeout: "{submodule-timeout}"
+          submodule-disable: "{submodule-disable}"
           choosing-strategy: default
-          jenkins-ssh-credential: '{jenkins-ssh-credential}'
+          jenkins-ssh-credential: "{jenkins-ssh-credential}"
 
     triggers:
-      - timed: '{obj:cron}'
+      - timed: "{obj:cron}"
       - github-pull-request:
-          trigger-phrase: '^build release$'
+          trigger-phrase: "^stage-(docker-)?release$"
           only-trigger-phrase: true
-          status-context: 'Maven Release'
+          status-context: "Maven Release"
           permit-all: true
           github-hooks: true
           white-list-target-branches:
-            - '{branch}'
-          included-regions: '{obj:github_included_regions}'
+            - "{branch}"
+          included-regions: "{obj:github_included_regions}"
 
 ###############
 # Maven Sonar #
 ###############
 
-- lf_maven_sonar: &lf_maven_sonar
+- _lf_maven_sonar: &lf_maven_sonar
     name: lf-maven-sonar
 
     ######################
     # Default parameters #
     ######################
 
-    branch: master  # Sonar should always be run on master branch
+    branch: master # Sonar should always be run on master branch
     build-days-to-keep: 7
     build-timeout: 60
-    cron: 'H H * * 6'  # run weekly
+    cron: "H H * * 6" # run weekly
     disable-job: false
-    git-url: '$GIT_URL/$PROJECT'
-    github-url: 'https://github.com'
-    java-version: openjdk8
+    git-url: "$GIT_URL/$PROJECT"
+    github-url: "https://github.com"
+    jacoco-exclude-pattern: "**/gen/**,**/generated-sources/**,**/yang-gen**,**/pax/**"
+    java-version: openjdk11
+    java-opts: ""
     mvn-global-settings: global-settings
     mvn-goals: clean install
-    mvn-opts: ''
-    mvn-params: ''
+    mvn-opts: ""
+    mvn-params: ""
     mvn-version: mvn35
-    sonar-mvn-goal: 'sonar:sonar'
+    sonar-mvn-goal: "sonar:sonar"
     sonarcloud: false
-    sonarcloud-project-key: ''
-    sonarcloud-project-organization: ''
-    sonarcloud-api-token: ''
+    sonarcloud-project-key: ""
+    sonarcloud-project-organization: ""
+    sonarcloud-api-token-cred-id: sonarcloud-api-token
+    sonarcloud-qualitygate-wait: false
+    # Projects not compatible with jdk13 can set java-version to something else
+    sonarcloud-java-version: openjdk13
     stream: master
     submodule-recursive: true
     submodule-timeout: 10
     submodule-disable: false
+    scan-dev-branch: false
 
     gerrit_sonar_triggers:
       - comment-added-contains-event:
     # Job Configuration #
     #####################
 
-    disabled: '{disable-job}'
+    disabled: "{disable-job}"
 
     parameters:
       - lf-infra-parameters:
-          project: '{project}'
-          branch: '{branch}'
-          stream: '{stream}'
+          project: "{project}"
+          branch: "{branch}"
+          stream: "{stream}"
       - lf-infra-maven-parameters:
-          mvn-opts: '{mvn-opts}'
-          mvn-params: '{mvn-params}'
-          mvn-version: '{mvn-version}'
+          mvn-opts: "{mvn-opts}"
+          mvn-params: "{mvn-params}"
+          mvn-version: "{mvn-version}"
       - string:
           name: ARCHIVE_ARTIFACTS
-          default: '{archive-artifacts}'
+          default: "{archive-artifacts}"
           description: Artifacts to archive to the logs server.
+      - string:
+          name: JAVA_OPTS
+          default: "{java-opts}"
+          description: |
+            Java options. Example: -Xmx1024m
       - string:
           name: SONAR_MAVEN_GOAL
-          default: '{sonar-mvn-goal}'
+          default: "{sonar-mvn-goal}"
           description: |
-              Maven goals to pass to the Sonar call. Typically sonar:sonar
-              however to use a specific version of the sonar-maven-plugin we
-              can call "org.codehaus.mojo:sonar-maven-plugin:3.3.0.603:sonar".
+            Maven goals to pass to the Sonar call. Typically sonar:sonar
+            however to use a specific version of the sonar-maven-plugin we
+            can call "org.codehaus.mojo:sonar-maven-plugin:3.3.0.603:sonar".
+
+    wrappers:
+      - credentials-binding:
+          - text:
+              credential-id: "{sonarcloud-api-token-cred-id}"
+              variable: API_TOKEN
 
     triggers:
-      - timed: '{obj:cron}'
+      - timed: "{obj:cron}"
       - gerrit:
-          server-name: '{gerrit-server-name}'
-          trigger-on: '{obj:gerrit_sonar_triggers}'
+          server-name: "{gerrit-server-name}"
+          trigger-on: "{obj:gerrit_sonar_triggers}"
           projects:
-            - project-compare-type: 'ANT'
-              project-pattern: '{project}'
+            - project-compare-type: "ANT"
+              project-pattern: "{project}"
               branches:
-                - branch-compare-type: 'ANT'
-                  branch-pattern: '**/master'
+                - branch-compare-type: "ANT"
+                  branch-pattern: "**/master"
           skip-vote:
             successful: true
             failed: true
             unstable: true
             notbuilt: true
 
+    publishers:
+      - lf-jacoco-report:
+          exclude-pattern: "{jacoco-exclude-pattern}"
+      - findbugs
+      - lf-infra-publish
+
+- _mvn_sonar_builders: &mvn_sonar_builders
+    name: mvn-sonar-builders
     builders:
       - lf-infra-pre-build
       # With SonarCloud
       - conditional-step:
           condition-kind: boolean-expression
-          condition-expression: '{sonarcloud}'
+          condition-expression: "{sonarcloud}"
           steps:
             - shell: echo 'Using SonarCloud'
             - lf-infra-maven-sonarcloud:
-                java-version: '{java-version}'
-                mvn-goals: '{mvn-goals}'
-                mvn-settings: '{mvn-settings}'
-                mvn-version: '{mvn-version}'
-                sonarcloud-project-key: '{sonarcloud-project-key}'
-                sonarcloud-project-organization: '{sonarcloud-project-organization}'
-                sonarcloud-api-token: '{sonarcloud-api-token}'
+                java-version: "{java-version}"
+                mvn-goals: "{mvn-goals}"
+                mvn-settings: "{mvn-settings}"
+                mvn-version: "{mvn-version}"
+                sonarcloud-project-key: "{sonarcloud-project-key}"
+                sonarcloud-project-organization: "{sonarcloud-project-organization}"
+                sonarcloud-java-version: "{sonarcloud-java-version}"
+                sonarcloud-qualitygate-wait: "{sonarcloud-qualitygate-wait}"
+                scan-dev-branch: "{scan-dev-branch}"
       # With SonarQube
       - conditional-step:
           condition-kind: not
           condition-operand:
             condition-kind: boolean-expression
-            condition-expression: '{sonarcloud}'
+            condition-expression: "{sonarcloud}"
           steps:
             - shell: echo 'Using SonarQube'
             - lf-infra-maven-sonar:
-                java-version: '{java-version}'
-                mvn-goals: '{mvn-goals}'
-                mvn-settings: '{mvn-settings}'
-                mvn-version: '{mvn-version}'
+                java-version: "{java-version}"
+                mvn-goals: "{mvn-goals}"
+                mvn-settings: "{mvn-settings}"
+                mvn-version: "{mvn-version}"
 
-    publishers:
-      - lf-jacoco-report
-      - findbugs
-      - lf-infra-publish
+- _mvn_sonar_builders_prescan_script: &mvn_sonar_builders_prescan_script
+    name: mvn-sonar-builders-prescan-script
+    builders:
+      - shell: "{sonar-prescan-script}"
+      - lf-infra-pre-build
+      # With SonarCloud
+      - conditional-step:
+          condition-kind: boolean-expression
+          condition-expression: "{sonarcloud}"
+          steps:
+            - shell: echo 'Using SonarCloud'
+            - lf-infra-maven-sonarcloud:
+                java-version: "{java-version}"
+                mvn-goals: "{mvn-goals}"
+                mvn-settings: "{mvn-settings}"
+                mvn-version: "{mvn-version}"
+                sonarcloud-project-key: "{sonarcloud-project-key}"
+                sonarcloud-project-organization: "{sonarcloud-project-organization}"
+                sonarcloud-java-version: "{sonarcloud-java-version}"
+                sonarcloud-qualitygate-wait: "{sonarcloud-qualitygate-wait}"
+                scan-dev-branch: "{scan-dev-branch}"
+      # With SonarQube
+      - conditional-step:
+          condition-kind: not
+          condition-operand:
+            condition-kind: boolean-expression
+            condition-expression: "{sonarcloud}"
+          steps:
+            - shell: echo 'Using SonarQube'
+            - lf-infra-maven-sonar:
+                java-version: "{java-version}"
+                mvn-goals: "{mvn-goals}"
+                mvn-settings: "{mvn-settings}"
+                mvn-version: "{mvn-version}"
+
+- builder:
+    name: lf-infra-maven-sbom-generator
+    # Run Maven goals and trigger SPDX SBOM Generator tool
+    builders:
+      - inject:
+          properties-content: |
+            SBOM_FLAGS={sbom-flags}
+      - shell: !include-raw-escape:
+          - ../shell/sbom-generator.sh
 
 - builder:
     name: lf-infra-maven-sonar
     # Run a Sonar build with Maven
     builders:
       - lf-maven-install:
-          mvn-version: '{mvn-version}'
+          mvn-version: "{mvn-version}"
       - lf-update-java-alternatives:
-          java-version: '{java-version}'
+          java-version: "{java-version}"
       - inject:
           # Switch this to the sonar wrapper when JJB 2.0 is available
           properties-content: |
             MAVEN_GOALS={mvn-goals}
       - lf-provide-maven-settings:
           global-settings-file: global-settings
-          settings-file: '{mvn-settings}'
+          settings-file: "{mvn-settings}"
       - shell: !include-raw-escape:
           - ../shell/common-variables.sh
           - ../shell/maven-sonar.sh
     # Run a Sonar build with Maven
     builders:
       - lf-maven-install:
-          mvn-version: '{mvn-version}'
+          mvn-version: "{mvn-version}"
       - lf-update-java-alternatives:
-          java-version: '{java-version}'
+          java-version: "{java-version}"
       - inject:
           # Switch this to the sonar wrapper when JJB 2.0 is available
           properties-content: |
             PROJECT_KEY={sonarcloud-project-key}
             PROJECT_ORGANIZATION={sonarcloud-project-organization}
             MAVEN_GOALS={mvn-goals}
-            API_TOKEN={sonarcloud-api-token}
+            SONARCLOUD_JAVA_VERSION={sonarcloud-java-version}
+            SCAN_DEV_BRANCH={scan-dev-branch}
+            SONARCLOUD_QUALITYGATE_WAIT={sonarcloud-qualitygate-wait}
       - lf-provide-maven-settings:
           global-settings-file: global-settings
-          settings-file: '{mvn-settings}'
+          settings-file: "{mvn-settings}"
       - shell: !include-raw-escape:
           - ../shell/common-variables.sh
           - ../shell/maven-sonar.sh
       - lf-provide-maven-settings-cleanup
 
 - job-template:
-    name: '{project-name}-sonar'
+    name: "{project-name}-sonar"
     id: gerrit-maven-sonar
     <<: *lf_maven_common
     # yamllint disable-line rule:key-duplicates
     <<: *lf_maven_sonar
+    <<: *mvn_sonar_builders
 
     scm:
       - lf-infra-gerrit-scm:
-          jenkins-ssh-credential: '{jenkins-ssh-credential}'
-          git-url: '{git-url}'
+          jenkins-ssh-credential: "{jenkins-ssh-credential}"
+          git-url: "{git-url}"
           refspec: $GERRIT_REFSPEC
           branch: $GERRIT_BRANCH
-          submodule-recursive: '{submodule-recursive}'
-          submodule-timeout: '{submodule-timeout}'
-          submodule-disable: '{submodule-disable}'
+          submodule-recursive: "{submodule-recursive}"
+          submodule-timeout: "{submodule-timeout}"
+          submodule-disable: "{submodule-disable}"
           choosing-strategy: default
 
 - job-template:
-    name: '{project-name}-sonar'
+    name: "{project-name}-sonar-verify"
+    id: gerrit-maven-sonar-verify
+    <<: *lf_maven_common
+    # yamllint disable-line rule:key-duplicates
+    <<: *lf_maven_sonar
+    <<: *mvn_sonar_builders
+
+    sonarcloud: true
+    scan-dev-branch: true
+    sonarcloud-qualitygate-wait: false
+
+    gerrit_sonar_triggers:
+      - patchset-created-event:
+          exclude-drafts: true
+          exclude-trivial-rebase: false
+          exclude-no-code-change: false
+      - draft-published-event
+      - comment-added-contains-event:
+          comment-contains-value: '^Patch Set\s+\d+:\s+(recheck|reverify)\s*$'
+
+    gerrit_trigger_file_paths:
+      - compare-type: REG_EXP
+        pattern: ".*"
+
+    triggers:
+      - gerrit:
+          server-name: "{gerrit-server-name}"
+          trigger-on: "{obj:gerrit_sonar_triggers}"
+          projects:
+            - project-compare-type: "ANT"
+              project-pattern: "{project}"
+              branches:
+                - branch-compare-type: "ANT"
+                  branch-pattern: "**/{branch}"
+              file-paths: "{obj:gerrit_trigger_file_paths}"
+
+    scm:
+      - lf-infra-gerrit-scm:
+          jenkins-ssh-credential: "{jenkins-ssh-credential}"
+          git-url: "{git-url}"
+          refspec: $GERRIT_REFSPEC
+          branch: $GERRIT_BRANCH
+          submodule-recursive: "{submodule-recursive}"
+          submodule-timeout: "{submodule-timeout}"
+          submodule-disable: "{submodule-disable}"
+          choosing-strategy: gerrit
+
+- job-template:
+    name: "{project-name}-sonar-prescan-script"
+    id: gerrit-maven-sonar-prescan-script
+    <<: *lf_maven_common
+    # yamllint disable-line rule:key-duplicates
+    <<: *lf_maven_sonar
+    <<: *mvn_sonar_builders_prescan_script
+
+    scm:
+      - lf-infra-gerrit-scm:
+          jenkins-ssh-credential: "{jenkins-ssh-credential}"
+          git-url: "{git-url}"
+          refspec: $GERRIT_REFSPEC
+          branch: $GERRIT_BRANCH
+          submodule-recursive: "{submodule-recursive}"
+          submodule-timeout: "{submodule-timeout}"
+          submodule-disable: "{submodule-disable}"
+          choosing-strategy: default
+
+- job-template:
+    name: "{project-name}-sonar"
     id: github-maven-sonar
     <<: *lf_maven_common
     # yamllint disable-line rule:key-duplicates
 
     properties:
       - lf-infra-properties:
-          build-days-to-keep: '{build-days-to-keep}'
+          build-days-to-keep: "{build-days-to-keep}"
+      - github:
+          url: "{github-url}/{github-org}/{project}"
+
+    scm:
+      - lf-infra-github-scm:
+          url: "{git-clone-url}{github-org}/{project}"
+          refspec: "+refs/pull/*:refs/remotes/origin/pr/*"
+          branch: "$sha1"
+          submodule-recursive: "{submodule-recursive}"
+          submodule-timeout: "{submodule-timeout}"
+          submodule-disable: "{submodule-disable}"
+          choosing-strategy: default
+          jenkins-ssh-credential: "{jenkins-ssh-credential}"
+
+    triggers:
+      - timed: "{obj:cron}"
+      - github-pull-request:
+          trigger-phrase: "^run-sonar$"
+          only-trigger-phrase: true
+          status-context: "Maven Sonar"
+          permit-all: true
+          github-hooks: true
+          org-list:
+            - "{github-org}"
+          white-list: "{obj:github_pr_allowlist}"
+          admin-list: "{obj:github_pr_admin_list}"
+          white-list-target-branches:
+            - "{branch}"
+
+- job-template:
+    name: "{project-name}-sonar-prescan-script"
+    id: github-maven-sonar-prescan-script
+    <<: *lf_maven_common
+    # yamllint disable-line rule:key-duplicates
+    <<: *lf_maven_sonar
+    <<: *mvn_sonar_builders_prescan_script
+
+    properties:
+      - lf-infra-properties:
+          build-days-to-keep: "{build-days-to-keep}"
       - github:
-          url: '{github-url}/{github-org}/{project}'
+          url: "{github-url}/{github-org}/{project}"
 
     scm:
       - lf-infra-github-scm:
-          url: '{git-clone-url}{github-org}/{project}'
-          refspec: '+refs/pull/*:refs/remotes/origin/pr/*'
-          branch: '$sha1'
-          submodule-recursive: '{submodule-recursive}'
-          submodule-timeout: '{submodule-timeout}'
-          submodule-disable: '{submodule-disable}'
+          url: "{git-clone-url}{github-org}/{project}"
+          refspec: "+refs/pull/*:refs/remotes/origin/pr/*"
+          branch: "$sha1"
+          submodule-recursive: "{submodule-recursive}"
+          submodule-timeout: "{submodule-timeout}"
+          submodule-disable: "{submodule-disable}"
           choosing-strategy: default
-          jenkins-ssh-credential: '{jenkins-ssh-credential}'
+          jenkins-ssh-credential: "{jenkins-ssh-credential}"
 
     triggers:
-      - timed: '{obj:cron}'
+      - timed: "{obj:cron}"
       - github-pull-request:
-          trigger-phrase: '^run-sonar$'
+          trigger-phrase: "^run-sonar$"
           only-trigger-phrase: true
-          status-context: 'Maven Sonar'
+          status-context: "Maven Sonar"
           permit-all: true
           github-hooks: true
           org-list:
-            - '{github-org}'
-          white-list: '{obj:github_pr_whitelist}'
-          admin-list: '{obj:github_pr_admin_list}'
+            - "{github-org}"
+          white-list: "{obj:github_pr_allowlist}"
+          admin-list: "{obj:github_pr_admin_list}"
           white-list-target-branches:
-            - '{branch}'
+            - "{branch}"
 
 ################
 # Maven Verify #
 ################
 
-- lf_maven_verify: &lf_maven_verify
+- _lf_maven_verify: &lf_maven_verify
     name: lf-maven-verify
 
     ######################
     build-days-to-keep: 7
     build-timeout: 60
     disable-job: false
-    git-url: '$GIT_URL/$PROJECT'
-    github-url: 'https://github.com'
-    java-version: openjdk8
+    git-url: "$GIT_URL/$PROJECT"
+    github-url: "https://github.com"
+    jacoco-exclude-pattern: "**/gen/**,**/generated-sources/**,**/yang-gen**,**/pax/**"
+    java-version: openjdk11
     mvn-global-settings: global-settings
     mvn-goals: clean deploy
-    mvn-opts: ''
-    mvn-params: '-Dstream=$STREAM -Dmaven.source.skip=true'
+    mvn-opts: ""
+    mvn-params: "-Dstream=$STREAM -Dmaven.source.skip=true"
     mvn-version: mvn35
+    pre-build-script: "# pre-build script goes here"
+    post-build-script: "# post-build script goes here"
     stream: master
     submodule-recursive: true
     submodule-timeout: 10
 
     gerrit_trigger_file_paths:
       - compare-type: REG_EXP
-        pattern: '.*'
+        pattern: ".*"
 
     # github_included_regions MUST match gerrit_trigger_file_paths
     github_included_regions:
-      - '.*'
+      - ".*"
 
     #####################
     # Job Configuration #
     #####################
 
     concurrent: true
-    disabled: '{disable-job}'
+    disabled: "{disable-job}"
 
     builders:
       - lf-infra-pre-build
       - lf-jacoco-nojava-workaround
       - lf-maven-install:
-          mvn-version: '{mvn-version}'
+          mvn-version: "{mvn-version}"
       - lf-update-java-alternatives:
-          java-version: '{java-version}'
+          java-version: "{java-version}"
       - lf-provide-maven-settings:
-          global-settings-file: '{mvn-global-settings}'
-          settings-file: '{mvn-settings}'
+          global-settings-file: "{mvn-global-settings}"
+          settings-file: "{mvn-settings}"
+      - shell: "{pre-build-script}"
       - lf-maven-build:
-          mvn-goals: '{mvn-goals}'
+          mvn-goals: "{mvn-goals}"
+      - shell: "{post-build-script}"
       - lf-provide-maven-settings-cleanup
 
     publishers:
       - findbugs
-      - lf-jacoco-report
+      - lf-jacoco-report:
+          exclude-pattern: "{jacoco-exclude-pattern}"
       - lf-infra-publish
 
 - job-template:
-    name: '{project-name}-maven-verify-{stream}-{mvn-version}-{java-version}'
+    name: "{project-name}-maven-verify-{stream}-{mvn-version}-{java-version}"
     id: gerrit-maven-verify
     <<: *lf_maven_common
     # yamllint disable-line rule:key-duplicates
 
     scm:
       - lf-infra-gerrit-scm:
-          jenkins-ssh-credential: '{jenkins-ssh-credential}'
-          git-url: '{git-url}'
-          refspec: '$GERRIT_REFSPEC'
-          branch: '$GERRIT_BRANCH'
-          submodule-recursive: '{submodule-recursive}'
-          submodule-timeout: '{submodule-timeout}'
-          submodule-disable: '{submodule-disable}'
+          jenkins-ssh-credential: "{jenkins-ssh-credential}"
+          git-url: "{git-url}"
+          refspec: "$GERRIT_REFSPEC"
+          branch: "$GERRIT_BRANCH"
+          submodule-recursive: "{submodule-recursive}"
+          submodule-timeout: "{submodule-timeout}"
+          submodule-disable: "{submodule-disable}"
           choosing-strategy: gerrit
 
     triggers:
       - gerrit:
-          server-name: '{gerrit-server-name}'
-          trigger-on: '{obj:gerrit_verify_triggers}'
+          server-name: "{gerrit-server-name}"
+          trigger-on: "{obj:gerrit_verify_triggers}"
           projects:
             - project-compare-type: ANT
-              project-pattern: '{project}'
+              project-pattern: "{project}"
               branches:
                 - branch-compare-type: ANT
-                  branch-pattern: '**/{branch}'
-              file-paths: '{obj:gerrit_trigger_file_paths}'
+                  branch-pattern: "**/{branch}"
+              file-paths: "{obj:gerrit_trigger_file_paths}"
 
 - job-template:
-    name: '{project-name}-maven-verify-{stream}-{mvn-version}-{java-version}'
+    name: "{project-name}-maven-verify-{stream}-{mvn-version}-{java-version}"
     id: github-maven-verify
     <<: *lf_maven_common
     # yamllint disable-line rule:key-duplicates
 
     properties:
       - lf-infra-properties:
-          build-days-to-keep: '{build-days-to-keep}'
+          build-days-to-keep: "{build-days-to-keep}"
       - github:
-          url: '{github-url}/{github-org}/{project}'
+          url: "{github-url}/{github-org}/{project}"
 
     scm:
       - lf-infra-github-scm:
-          url: '{git-clone-url}{github-org}/{project}'
-          refspec: '+refs/pull/*:refs/remotes/origin/pr/*'
-          branch: '$sha1'
-          submodule-recursive: '{submodule-recursive}'
-          submodule-timeout: '{submodule-timeout}'
-          submodule-disable: '{submodule-disable}'
+          url: "{git-clone-url}{github-org}/{project}"
+          refspec: "+refs/pull/*:refs/remotes/origin/pr/*"
+          branch: "$sha1"
+          submodule-recursive: "{submodule-recursive}"
+          submodule-timeout: "{submodule-timeout}"
+          submodule-disable: "{submodule-disable}"
           choosing-strategy: default
-          jenkins-ssh-credential: '{jenkins-ssh-credential}'
+          jenkins-ssh-credential: "{jenkins-ssh-credential}"
 
     triggers:
       - github-pull-request:
-          trigger-phrase: '^(recheck|reverify)$'
+          trigger-phrase: "^(recheck|reverify)$"
           only-trigger-phrase: false
-          status-context: 'Maven Verify {mvn-version}-{java-version}'
+          status-context: "Maven Verify {mvn-version}-{java-version}"
           permit-all: true
           github-hooks: true
           white-list-target-branches:
-            - '{branch}'
-          included-regions: '{obj:github_included_regions}'
+            - "{branch}"
+          included-regions: "{obj:github_included_regions}"
 
 ###########################
 # Maven Verify for Docker #
 ###########################
 
-- lf_maven_docker_verify: &lf_maven_docker_verify
+- _lf_maven_docker_verify: &lf_maven_docker_verify
     name: lf-maven-docker-verify
 
     # image push not allowed during verification
       - lf-infra-pre-build
       - lf-jacoco-nojava-workaround
       - lf-maven-install:
-          mvn-version: '{mvn-version}'
+          mvn-version: "{mvn-version}"
       - lf-update-java-alternatives:
-          java-version: '{java-version}'
+          java-version: "{java-version}"
       - lf-infra-docker-login:
-          global-settings-file: '{mvn-global-settings}'
-          settings-file: '{mvn-settings}'
+          global-settings-file: "{mvn-global-settings}"
+          settings-file: "{mvn-settings}"
       # must provide maven settings AFTER docker due to its cleanup
       - lf-provide-maven-settings:
-          global-settings-file: '{mvn-global-settings}'
-          settings-file: '{mvn-settings}'
+          global-settings-file: "{mvn-global-settings}"
+          settings-file: "{mvn-settings}"
       - inject:
           properties-content: |
-              CONTAINER_PULL_REGISTRY={container-public-registry}
+            CONTAINER_PULL_REGISTRY={container-public-registry}
       - lf-maven-build:
-          mvn-goals: '{mvn-goals}'
+          mvn-goals: "{mvn-goals}"
       - lf-provide-maven-settings-cleanup
 
 - job-template:
-    name: '{project-name}-maven-docker-verify-{stream}-{mvn-version}-{java-version}'
+    name: "{project-name}-maven-docker-verify-{stream}-{mvn-version}-{java-version}"
     id: gerrit-maven-docker-verify
     <<: *lf_maven_common
     # yamllint disable-line rule:key-duplicates
 
     scm:
       - lf-infra-gerrit-scm:
-          jenkins-ssh-credential: '{jenkins-ssh-credential}'
-          git-url: '{git-url}'
-          refspec: '$GERRIT_REFSPEC'
-          branch: '$GERRIT_BRANCH'
-          submodule-recursive: '{submodule-recursive}'
-          submodule-timeout: '{submodule-timeout}'
-          submodule-disable: '{submodule-disable}'
+          jenkins-ssh-credential: "{jenkins-ssh-credential}"
+          git-url: "{git-url}"
+          refspec: "$GERRIT_REFSPEC"
+          branch: "$GERRIT_BRANCH"
+          submodule-recursive: "{submodule-recursive}"
+          submodule-timeout: "{submodule-timeout}"
+          submodule-disable: "{submodule-disable}"
           choosing-strategy: gerrit
 
     triggers:
       - gerrit:
-          server-name: '{gerrit-server-name}'
-          trigger-on: '{obj:gerrit_verify_triggers}'
+          server-name: "{gerrit-server-name}"
+          trigger-on: "{obj:gerrit_verify_triggers}"
           projects:
             - project-compare-type: ANT
-              project-pattern: '{project}'
+              project-pattern: "{project}"
               branches:
                 - branch-compare-type: ANT
-                  branch-pattern: '**/{branch}'
-              file-paths: '{obj:gerrit_trigger_file_paths}'
+                  branch-pattern: "**/{branch}"
+              file-paths: "{obj:gerrit_trigger_file_paths}"
 
 - job-template:
-    name: '{project-name}-maven-docker-verify-{stream}-{mvn-version}-{java-version}'
+    name: "{project-name}-maven-docker-verify-{stream}-{mvn-version}-{java-version}"
     id: github-maven-docker-verify
     <<: *lf_maven_common
     # yamllint disable-line rule:key-duplicates
 
     properties:
       - lf-infra-properties:
-          build-days-to-keep: '{build-days-to-keep}'
+          build-days-to-keep: "{build-days-to-keep}"
       - github:
-          url: '{github-url}/{github-org}/{project}'
+          url: "{github-url}/{github-org}/{project}"
 
     scm:
       - lf-infra-github-scm:
-          url: '{git-clone-url}{github-org}/{project}'
-          refspec: '+refs/pull/*:refs/remotes/origin/pr/*'
-          branch: '$sha1'
-          submodule-recursive: '{submodule-recursive}'
-          submodule-timeout: '{submodule-timeout}'
-          submodule-disable: '{submodule-disable}'
+          url: "{git-clone-url}{github-org}/{project}"
+          refspec: "+refs/pull/*:refs/remotes/origin/pr/*"
+          branch: "$sha1"
+          submodule-recursive: "{submodule-recursive}"
+          submodule-timeout: "{submodule-timeout}"
+          submodule-disable: "{submodule-disable}"
           choosing-strategy: default
-          jenkins-ssh-credential: '{jenkins-ssh-credential}'
+          jenkins-ssh-credential: "{jenkins-ssh-credential}"
 
     triggers:
       - github-pull-request:
-          trigger-phrase: '^(recheck|reverify)$'
+          trigger-phrase: "^(recheck|reverify)$"
           only-trigger-phrase: false
-          status-context: 'Maven Docker Verify {mvn-version}-{java-version}'
+          status-context: "Maven Docker Verify {mvn-version}-{java-version}"
           permit-all: true
           github-hooks: true
           white-list-target-branches:
-            - '{branch}'
-          included-regions: '{obj:github_included_regions}'
+            - "{branch}"
+          included-regions: "{obj:github_included_regions}"
 
 #############################
 # Maven Verify Dependencies #
 #############################
 
-- lf_maven_verify_dependencies: &lf_maven_verify_dependencies
+- _lf_maven_verify_dependencies: &lf_maven_verify_dependencies
     name: lf-maven-verify-dependencies
 
     ######################
     build-days-to-keep: 7
     build-timeout: 60
     disable-job: false
-    git-url: '$GIT_URL/$PROJECT'
-    github-url: 'https://github.com'
-    java-version: openjdk8
+    git-url: "$GIT_URL/$PROJECT"
+    github-url: "https://github.com"
+    jacoco-exclude-pattern: "**/gen/**,**/generated-sources/**,**/yang-gen**,**/pax/**"
+    java-version: openjdk11
     mvn-global-settings: global-settings
     mvn-goals: clean deploy
-    mvn-opts: ''
-    mvn-params: '-Dstream=$STREAM'
+    mvn-opts: ""
+    mvn-params: "-Dstream=$STREAM"
     mvn-version: mvn35
     stream: master
     submodule-recursive: true
 
     gerrit_verify_triggers:
       - comment-added-contains-event:
-          comment-contains-value: 'recheck: [0-9 ]+'
+          comment-contains-value: "recheck: [0-9 ]+"
     gerrit_trigger_file_paths:
       - compare-type: ANT
-        pattern: '**'
+        pattern: "**"
 
     #####################
     # Job Configuration #
     #####################
 
     concurrent: true
-    disabled: '{disable-job}'
+    disabled: "{disable-job}"
 
     builders:
       - lf-infra-pre-build
       - lf-jacoco-nojava-workaround
       - lf-maven-install:
-          mvn-version: '{mvn-version}'
+          mvn-version: "{mvn-version}"
       - lf-update-java-alternatives:
-          java-version: '{java-version}'
+          java-version: "{java-version}"
       - lf-provide-maven-settings:
-          global-settings-file: '{mvn-global-settings}'
-          settings-file: '{mvn-settings}'
+          global-settings-file: "{mvn-global-settings}"
+          settings-file: "{mvn-settings}"
       - lf-fetch-dependent-patches
       - shell: !include-raw-escape:
           - ../shell/common-variables.sh
           - ../shell/maven-build-deps.sh
       - lf-maven-build:
-          mvn-goals: '{mvn-goals}'
+          mvn-goals: "{mvn-goals}"
       - lf-provide-maven-settings-cleanup
 
     publishers:
       - findbugs
-      - lf-jacoco-report
+      - lf-jacoco-report:
+          exclude-pattern: "{jacoco-exclude-pattern}"
       - lf-infra-publish
 
 - job-template:
-    name: '{project-name}-maven-verify-deps-{stream}-{mvn-version}-{java-version}'
+    name: "{project-name}-maven-verify-deps-{stream}-{mvn-version}-{java-version}"
     id: gerrit-maven-verify-dependencies
     <<: *lf_maven_common
     # yamllint disable-line rule:key-duplicates
 
     scm:
       - lf-infra-gerrit-scm:
-          jenkins-ssh-credential: '{jenkins-ssh-credential}'
-          git-url: '{git-url}'
-          refspec: '$GERRIT_REFSPEC'
-          branch: '$GERRIT_BRANCH'
-          submodule-recursive: '{submodule-recursive}'
-          submodule-timeout: '{submodule-timeout}'
-          submodule-disable: '{submodule-disable}'
+          jenkins-ssh-credential: "{jenkins-ssh-credential}"
+          git-url: "{git-url}"
+          refspec: "$GERRIT_REFSPEC"
+          branch: "$GERRIT_BRANCH"
+          submodule-recursive: "{submodule-recursive}"
+          submodule-timeout: "{submodule-timeout}"
+          submodule-disable: "{submodule-disable}"
           choosing-strategy: gerrit
 
     triggers:
       - gerrit:
-          server-name: '{gerrit-server-name}'
-          trigger-on: '{obj:gerrit_verify_triggers}'
+          server-name: "{gerrit-server-name}"
+          trigger-on: "{obj:gerrit_verify_triggers}"
           projects:
             - project-compare-type: ANT
-              project-pattern: '{project}'
+              project-pattern: "{project}"
               branches:
                 - branch-compare-type: ANT
-                  branch-pattern: '**/{branch}'
-              file-paths: '{obj:gerrit_trigger_file_paths}'
+                  branch-pattern: "**/{branch}"
+              file-paths: "{obj:gerrit_trigger_file_paths}"
+          comment-text-parameter-mode: PLAIN