We have a Spring Boot application, and in it we have both an application.properties and a application-dev.properties. The application properties file just has some across the board default values, and the application-dev properties has some really rudimentary credentials in it.
When we deploy our jar, the application gets its properties from the environment its deployed to so, we don't utilize the profiles feature except when we want to develop locally against our 'dev' environment.
Our secops department has told us that they no longer want us to include that dev properties file from the final jar that's deployed to production, but they have ok'd us leaving the file in version control so we can at least track changes and build/run locally.
I've been reading through the spring-boot-maven-plugin configuration, and I can't see a way to just tell maven to exclude that file when building the final jar while still copying it into the target directory so our team can still do their hacking locally.