add waffle badge

.github/renovate.json

@@ -0,0 +1,6 @@
+{
+  "extends": [
+    "config:base",
+    ":gitSignOff"
+  ]
+}

.github/workflows/build.yml

@@ -0,0 +1,43 @@
+name: build
+
+on: [push, pull_request]
+
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        java-version: [8, 11, 12, 13, 14, 15, 16, 17, 18, 19, 20, 21, 22, 23]
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+      - name: Set up Java ${{matrix.java-version}}
+        uses: actions/setup-java@v4
+        with:
+          distribution: zulu
+          java-version: ${{matrix.java-version}}
+      - name: Run tests
+        run: ./mvnw --batch-mode --no-transfer-progress -e test
+
+  coverage:
+    needs: test
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+      - name: Create code coverage report
+        run: ./mvnw --batch-mode --no-transfer-progress -e test jacoco:report
+      - name: Upload code coverage report
+        uses: codecov/codecov-action@v5
+        with:
+          files: target/site/jacoco/jacoco.xml
+          name: codecov
+
+  dependency-check:
+      needs: test
+      runs-on: ubuntu-latest
+      steps:
+        - name: Checkout
+          uses: actions/checkout@v4
+        - name: Check dependencies
+          run: ./mvnw --batch-mode --no-transfer-progress -e dependency-check:check -DnvdApiKey='${{ secrets.NVD_API_KEY }}'

.gitignore

@@ -1,3 +1,5 @@
 *.iml
 .idea
 target
+.mvn/wrapper/*.jar
+.mvn/settings.xml

.mvn/owasp-suppressions.xml

@@ -0,0 +1,10 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<suppressions xmlns="https://jeremylong.github.io/DependencyCheck/dependency-suppression.1.3.xsd">
+    <suppress base="true">
+        <notes><![CDATA[
+        Suppresses a positive for a tempDir component in Guava that we do not use.
+        ]]></notes>
+        <packageUrl regex="true">^pkg:maven/com\.google\.guava/guava@.*$</packageUrl>
+        <vulnerabilityName>CVE-2020-8908</vulnerabilityName>
+    </suppress>
+</suppressions>

.mvn/wrapper/maven-wrapper.properties

@@ -0,0 +1,17 @@
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements.  See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership.  The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License.  You may obtain a copy of the License at
+#
+#   http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied.  See the License for the
+# specific language governing permissions and limitations
+# under the License.
+distributionUrl=https://repo.maven.apache.org/maven2/org/apache/maven/apache-maven/3.9.9/apache-maven-3.9.9-bin.zip

CONTRIBUTING.md

@@ -0,0 +1,65 @@
+# Contributing
+
+Contributions are very welcome!
+
+## How to contribute
+
+We love pull requests. Here is a quick guide:
+
+1. Fork the repo.
+2. Create a new branch from `master`.
+3. Add your change together with necessary tests.
+4. Run `mvn clean verify` and ensure all tests are passing.
+5. Commit with a DCO sign-off message (see next section) and push to your fork/branch.
+6. Create a pull request.
+
+##  Sign your work – the Developer's Certificate of Origin
+The sign-off is a simple line at the end of the explanation for the patch,
+which certifies that you wrote it or otherwise have the right to pass it on as an open-source patch.
+The rules are pretty simple:
+You need to certify the below (from [developercertificate.org](https://developercertificate.org/)):
+
+> Developer's Certificate of Origin 1.1
+>
+> By making a contribution to this project, I certify that:
+>
+> (a) The contribution was created in whole or in part by me and I
+>     have the right to submit it under the open source license
+>     indicated in the file; or
+>
+> (b) The contribution is based upon previous work that, to the best
+>     of my knowledge, is covered under an appropriate open source
+>     license and I have the right under that license to submit that
+>     work with modifications, whether created in whole or in part
+>     by me, under the same open source license (unless I am
+>     permitted to submit under a different license), as indicated
+>     in the file; or
+>
+> (c) The contribution was provided directly to me by some other
+>     person who certified (a), (b) or (c) and I have not modified
+>     it.
+>
+> (d) I understand and agree that this project and the contribution
+>     are public and that a record of the contribution (including all
+>     personal information I submit with it, including my sign-off) is
+>     maintained indefinitely and may be redistributed consistent with
+>     this project or the open source license(s) involved.
+
+#### DCO Sign-Off Methods
+
+The DCO requires a sign-off message in the following format appear on each commit in the pull request:
+
+    Signed-off-by: Random J Developer <[email protected]>
+
+using your real name (sorry, no pseudonyms or anonymous contributions.)
+
+The DCO text can either be manually added to your commit body,
+or you can add either **`-s`** or **`--signoff`** to your usual **`git commit`** commands.
+If you forget to add the sign-off you can also amend a previous commit with the sign-off
+by running **`git commit --amend -s`**.
+If you've pushed your changes to Github already
+you'll need to force push your branch after this with **`git push -f`**.
+
+#### Alternative Sign-Off Methods in rare cases
+
+If it is really no option for you to disclose your real name and email address, there might be a chance that you can get your contribution accepted. In this case please contact the maintainers directly and verify the adherence to the DCO of the contribution manually. This might include quite some legal overhead for both parties.