build.gradle

plugins {
  id 'application'
  id 'checkstyle'
  id 'jacoco'
  id 'io.spring.dependency-management' version '1.0.12.RELEASE'
  id 'org.springframework.boot' version '2.5.14'
  id 'org.owasp.dependencycheck' version '8.1.2'
  id 'com.github.ben-manes.versions' version '0.46.0'
  id 'org.sonarqube' version '3.4.0.2513'
  id 'au.com.dius.pact' version '4.2.14'
  id "io.freefair.lombok" version "6.6.3"
  id "org.flywaydb.flyway" version "9.0.1"
}

group = 'uk.gov.hmcts.reform'
version = '0.0.1'

allprojects {
  java {
    toolchain {
      languageVersion = JavaLanguageVersion.of(17)
    }
  }

  apply plugin: 'java'
  apply plugin: 'jacoco'
  apply plugin: 'checkstyle'
  apply plugin: 'io.spring.dependency-management'
  apply plugin: 'org.springframework.boot'
  apply plugin: 'org.owasp.dependencycheck'
  apply plugin: 'com.github.ben-manes.versions'

  checkstyle {
    maxWarnings = 0
    toolVersion = '10.4'
    getConfigDirectory().set(new File(rootDir, 'config/checkstyle'))
  }

  jacoco {
    toolVersion = '0.8.8' // jacocoMavenPluginVersion
    reportsDirectory = file("$buildDir/reports/jacoco")
  }

// before committing a change, make sure task still works
  dependencyUpdates {
    def isNonStable = { String version ->
      def stableKeyword = ['RELEASE', 'FINAL', 'GA'].any { qualifier -> version.toUpperCase().contains(qualifier) }
      def regex = /^[0-9,.v-]+$/
      return !stableKeyword && !(version ==~ regex)
    }
    rejectVersionIf { selection -> // <---- notice how the closure argument is named
      return isNonStable(selection.candidate.version) && !isNonStable(selection.currentVersion)
    }
  }

// https://jeremylong.github.io/DependencyCheck/dependency-check-gradle/configuration.html
  dependencyCheck {
    // Specifies if the build should be failed if a CVSS score above a specified level is identified.
    // range of 0-10 fails the build, anything greater and it doesn't fail the build
    failBuildOnCVSS = System.getProperty('dependencyCheck.failBuild') == 'true' ? 0 : 11
    suppressionFile = 'config/owasp/suppressions.xml'
    cveValidForHours = 24

    analyzers {
      // Disable scanning of .NET related binaries
      assemblyEnabled = false
      retirejs {
        enabled = false
      }
      ossIndex {
        enabled = false
      }
    }
  }

  dependencyManagement {
    dependencies {
      dependency group: 'org.bouncycastle', name: 'bcpkix-jdk15on', version: '1.70'
      // CVE-2018-10237 - Unbounded memory allocation
      dependency group: 'org.mybatis', name: 'mybatis', version: '3.5.13'
      // CVE-2020-26945 - Mishandles deserialization of object streams.
      dependencySet(group: 'com.google.guava', version: '32.1.1-jre') {
        entry 'guava'
      }
      dependency group: 'org.jetbrains.kotlin', name: 'kotlin-stdlib-common', version: '1.8.20'
      dependency group: 'org.jetbrains.kotlin', name: 'kotlin-stdlib-jdk7', version: '1.8.20'
      dependency group: 'org.jetbrains.kotlin', name: 'kotlin-stdlib-jdk8', version: '1.8.20'
      dependency group: 'org.jetbrains.kotlin', name: 'kotlin-stdlib', version: '1.8.20'
      dependency group: 'org.jetbrains.kotlin', name: 'kotlin-reflect', version: '1.8.20'
      // CVE-2020-29582

      // CVE-2021-29425
      dependency group: 'commons-io', name: 'commons-io', version: '2.11.0'
      dependency group: 'com.squareup.okhttp3', name: 'okhttp', version: '4.10.0'
      dependency group: 'org.springframework.security', name: 'spring-security-crypto', version: '5.8.3'

      dependency group: 'com.fasterxml.jackson.core', name: 'jackson-databind', version: '2.14.2'
      dependency group: 'com.fasterxml.jackson.core', name: 'jackson-core', version: '2.14.2'

      // To prevent other libraries using conflicting versions
      dependency group: 'org.slf4j', name: 'slf4j-nop', version: '2.0.5'

      // solves CVE-2022-25857
      dependencySet(
        group: 'org.yaml',
        version: '1.33'
      ) {
        entry 'snakeyaml'
      }
      // Solves CVE-2022-25647
      dependencySet(
        group: 'org.camunda.bpm',
        version: '7.17.0'
      ) {
        entry 'camunda-engine'
      }
      // Solves CVE-2022-31159, happens only on local builds when running dependencyCheck gradle task
      dependencySet(
        group: 'com.amazonaws',
        version: '1.12.512'
      ) {
        entry 'aws-java-sdk-core'
        entry 'aws-java-sdk-kms'
        entry 'aws-java-sdk-s3'
      }
      // Solves CVE-2020-17521
      dependencySet(
        group: 'org.codehaus.groovy',
        version: '2.4.21'
      ) {
        entry 'groovy-all'
      }

      // Solves CVE-2023-24998
      dependency group: 'commons-fileupload', name: 'commons-fileupload', version: '1.5'
    }
    imports {
      mavenBom 'org.springframework.cloud:spring-cloud-dependencies:2020.0.6'
      mavenBom "com.azure.spring:spring-cloud-azure-dependencies:4.9.0"
    }
  }

  configurations {
    testCompile.exclude group: 'ch.qos.logback', module: 'logback-classic'
  }

  repositories {
    mavenLocal()
    mavenCentral()
    maven {
      url "https://jitpack.io"
    }
    maven {
      url "https://jitpack.io"
    }
    jcenter()
  }
}

sourceSets {
  integrationTest {
    java {
      compileClasspath += main.output
      runtimeClasspath += main.output
      srcDir file('src/integrationTest/java')
    }
    resources.srcDir file('src/integrationTest/resources')
  }

  contractTest {
    java {
      compileClasspath += main.output
      runtimeClasspath += main.output
      srcDir file('src/contractTest/java')
    }
    resources.srcDir file('src/contractTest/resources')
  }
}

tasks.withType(JavaCompile) {
  options.compilerArgs << "-Xlint:unchecked" << "-Werror"
}

tasks.withType(Test) {
  useJUnitPlatform()

  testLogging {
    exceptionFormat = 'full'
  }
}

test {
  failFast = true
}

task integration(type: Test) {
  description = "Runs integration tests"
  group = "Verification"
  testClassesDirs = sourceSets.integrationTest.output.classesDirs
  classpath = sourceSets.integrationTest.runtimeClasspath
  failFast = true
  testLogging.showStandardStreams = false
}

task contract(type: Test) {
  useJUnitPlatform()
  description = "Runs pact contract tests"
  group = "Delivery pipeline"
  testClassesDirs = sourceSets.contractTest.output.classesDirs
  classpath = sourceSets.contractTest.runtimeClasspath
}

task pullTestAsset(type: Exec, description: 'Installs Yarn dependencies.') {
  commandLine './bin/pull-latest-ccd-files.sh', 'master'
}

task fortifyScan(type: JavaExec, description: 'Run fortify scan.')  {
  getMainClass().set("uk.gov.hmcts.fortifyclient.FortifyClientMainApp")
  classpath += sourceSets.test.runtimeClasspath
  jvmArgs = ['--add-opens=java.base/java.lang.reflect=ALL-UNNAMED']
}

task awaitApplicationReadiness(type: Exec, description: 'Awaits until application is ready.') {
  commandLine './bin/wait-for.sh'
  commandLine './bin/wait-for.sh', 'manage-case'
}

task runSmokeTests(type: Exec, description: 'Runs smoke tests.') {
  commandLine '/usr/bin/yarn', '--silent', 'run', 'test:smoke'
}

task runProdApiTests(type: Exec, description: 'Runs Prod features in functional tests.') {
  commandLine '/usr/bin/yarn', '--silent', 'run', 'test:api-prod'
}

task runNonProdApiTests(type: Exec, description: 'Runs Non Prod featuers in functional tests.') {
  onlyIf {
    return System.env.ENVIRONMENT == 'preview'
  }
  commandLine '/usr/bin/yarn', '--silent', 'run', 'test:api-nonprod'
}

task runNightlyApiTests(type: Exec, description: 'Runs additional multiparty nightly tests.') {
  onlyIf {
    return System.env.NIGHTLY_RUN == 'true'
  }
  commandLine '/usr/bin/yarn', '--silent', 'run', 'test:api-nightly-prod'
}

task runCrossBrowserTests(type: Exec, description: 'Runs cross browser tests.') {
  commandLine '/usr/bin/yarn', '--silent', 'run', 'test:crossbrowser'
}

def inStrictOrder(Task... tasks) {
  for (int i = 0; i < tasks.size() - 1; i++) {
    tasks[i + 1].mustRunAfter(tasks[i])
  }
  return tasks
}

task smoke(description: 'Runs the smoke tests.') {
  dependsOn(inStrictOrder(awaitApplicationReadiness, runSmokeTests))
}

task functional(description: 'Runs the functional tests.') {
  dependsOn(inStrictOrder(awaitApplicationReadiness,
    runProdApiTests, runNonProdApiTests, runNightlyApiTests))
}

task crossbrowser(description: 'Runs the crossbrowser tests.') {
  dependsOn(inStrictOrder(awaitApplicationReadiness, pullTestAsset, runCrossBrowserTests))
}

project.tasks['sonarqube'].dependsOn test, integration, jacocoTestReport

sonarqube {
  properties {
    property "sonar.projectName", "CIVIL :: service"
    property "sonar.projectKey", "civil-service"
    property "sonar.coverage.jacoco.xmlReportPaths", "${jacocoTestReport.reports.xml.destination.path}"
    property "sonar.coverage.exclusions", "**/model/**, **/config/**/*Configuration.java, **/testingsupport/**, **/*ExternalTaskListener.java, **/*BaseExternalTaskHandler.java, **/stereotypes/**, **/*Exception.java, **/EventHistoryMapper*.java, **/model/hearingvalues/**, **/enums/hearing/**, **/fees/client/**, **/enums/sdo/**"
    property "sonar.cpd.exclusions", "**/*DocumentManagementService.java, **/*Spec*.java"
    property "sonar.exclusions", "**/hmc/model/**, **/model/hearingvalues/**"
    property "sonar.host.url", "https://sonar.reform.hmcts.net/"
  }
}

jacocoTestReport {
  executionData(test, integration)
  executionData fileTree(project.rootDir.absolutePath).include("**/build/jacoco/*.exec")
  subprojects.each {
    sourceSets it.sourceSets.main
  }
  reports {
    xml.enabled = true
    csv.enabled = false
    xml.destination file("${buildDir}/reports/jacoco/test/jacocoTestReport.xml")
  }
}

jacocoTestReport.dependsOn {
  subprojects*.test
}

def versions = [
  junit              : '5.9.3',
  junitPlatform      : '1.9.3',
  reformLogging      : '5.1.7',
  springBoot         : springBoot.class.package.implementationVersion,
  springStatemachine : '3.2.0',
  lombok             : '1.18.26',
  pact               : '3.5.24',
  springSecurity     : '5.8.3'
]

ext.libraries = [
  junit5: [
    "org.junit.jupiter:junit-jupiter-api:${versions.junit}",
    "org.junit.jupiter:junit-jupiter-engine:${versions.junit}",
    "org.junit.jupiter:junit-jupiter-params:${versions.junit}",
    "org.junit.platform:junit-platform-commons:${versions.junitPlatform}",
    "org.junit.platform:junit-platform-engine:${versions.junitPlatform}"
  ]
]

configurations.all {
  resolutionStrategy.eachDependency { details ->
    if (details.requested.group == 'org.projectlombok') {
      details.useVersion versions.lombok
    }
  }
  exclude group: 'org.springframework.security', module: 'spring-security-rsa'
}

dependencies {
  implementation 'com.github.hmcts:civil-commons:1.0.9'

  implementation group: 'org.springframework.boot', name: 'spring-boot-starter-web'
  implementation group: 'org.springframework.boot', name: 'spring-boot-starter-actuator'
  implementation group: 'org.springframework.boot', name: 'spring-boot-starter-aop'
  implementation group: 'org.springframework', name: 'spring-aspects'
  implementation group: 'org.springframework.boot', name: 'spring-boot-starter-json'
  implementation group: 'org.springframework.boot', name: 'spring-boot-starter-validation'
  implementation group: 'org.springframework.boot', name: 'spring-boot-starter-jdbc'

  implementation group: 'org.springframework.statemachine', name: 'spring-statemachine-core', version: versions.springStatemachine
  implementation group: 'org.springframework.statemachine', name: 'spring-statemachine-test', version: versions.springStatemachine


  implementation group: 'org.springdoc', name: 'springdoc-openapi-ui', version: '1.7.0'
  implementation group: 'org.postgresql', name: 'postgresql', version: '42.6.0'

  implementation group: 'org.jdbi', name: 'jdbi3-sqlobject', version: '3.39.1'
  implementation group: 'org.jdbi', name: 'jdbi3-spring4', version: '3.19.0'

  implementation group: 'org.flywaydb', name: 'flyway-core'

  implementation group: 'uk.gov.hmcts.reform', name: 'logging', version: versions.reformLogging
  implementation group: 'uk.gov.hmcts.reform', name: 'logging-appinsights', version: versions.reformLogging
  implementation group: 'org.springframework.cloud', name: 'spring-cloud-starter-netflix-hystrix', version: '2.2.10.RELEASE'
  implementation group: 'org.springframework.cloud', name: 'spring-cloud-starter-openfeign', version: '3.1.6'
  implementation group: 'org.springframework.cloud', name: 'spring-cloud-openfeign-core', version: '3.1.6'
  implementation group: 'uk.gov.hmcts.reform', name: 'properties-volume-spring-boot-starter', version: '0.1.0'
  implementation group: 'uk.gov.hmcts.reform', name: 'service-auth-provider-client', version: '4.0.0'

  implementation group: 'io.github.openfeign', name: 'feign-httpclient', version: '12.4'
  implementation group: 'org.springframework.retry', name: 'spring-retry'

  implementation group: 'com.github.hmcts', name: 'ccd-client', version: '4.9.1'
  implementation group: 'uk.gov.hmcts.reform', name: 'document-management-client', version: '7.0.0'
  implementation group: 'uk.gov.hmcts.reform', name: 'send-letter-client', version: '3.0.3'
  implementation group: 'com.github.hmcts', name: 'fees-java-client', version: '0.0.6'
  implementation group: 'com.github.hmcts', name: 'payments-java-client', version: '1.5.2'
  implementation group: 'uk.gov.hmcts.reform', name: 'service-auth-provider-client', version: '4.0.0'
  implementation group: 'uk.gov.hmcts.reform', name: 'properties-volume-spring-boot-starter', version: '0.1.0'
  implementation group: 'uk.gov.service.notify', name: 'notifications-java-client', version: '3.19.1-RELEASE'
  implementation group: 'com.github.hmcts', name: 'ccd-case-document-am-client', version: '1.7.1'
  implementation group: 'com.sendgrid', name: 'sendgrid-java', version: '4.9.3'

  annotationProcessor group: 'org.projectlombok', name: 'lombok', version: versions.lombok
  compileOnly group: 'org.projectlombok', name: 'lombok', version: versions.lombok

  implementation group: 'org.springframework.boot', name: 'spring-boot-starter-cache'
  implementation group: 'com.github.ben-manes.caffeine', name: 'caffeine', version: '3.1.5'

  implementation group: 'org.springframework.security', name: 'spring-security-web', version: versions.springSecurity
  implementation group: 'org.springframework.security', name: 'spring-security-config', version: versions.springSecurity
  // CVE-2021-22112 - Privilege Escalation
  implementation group: 'org.springframework.security', name: 'spring-security-core', version: versions.springSecurity
  implementation group: 'org.springframework.security', name: 'spring-security-oauth2-resource-server', version: versions.springSecurity
  implementation group: 'org.springframework.security', name: 'spring-security-oauth2-client', version: versions.springSecurity
  implementation group: 'org.springframework.security', name: 'spring-security-oauth2-jose', version: versions.springSecurity
  implementation group: 'org.springframework.security', name: 'spring-security-oauth2-core', version: versions.springSecurity
  implementation group: 'com.nimbusds', name: 'nimbus-jose-jwt', version: '9.31'
  implementation group: 'io.jsonwebtoken', name: 'jjwt', version: '0.9.1'
  implementation group: 'uk.gov.hmcts.reform', name: 'idam-client', version: '2.0.0'

  implementation group: 'org.apache.logging.log4j', name: 'log4j-api', version: '2.20.0'
  implementation group: 'org.apache.logging.log4j', name: 'log4j-to-slf4j', version: '2.20.0'
  implementation group: 'org.apache.commons', name: 'commons-text', version: '1.10.0'
  implementation group: 'org.apache.tomcat.embed', name: 'tomcat-embed-core', version: '9.0.73'
  implementation group: 'org.apache.tomcat.embed', name: 'tomcat-embed-websocket', version: '10.1.7'
  implementation group: 'org.elasticsearch', name: 'elasticsearch', version: '7.17.9'
  implementation group: 'com.networknt', name: 'json-schema-validator', version: '1.0.78'

  implementation group: 'org.camunda.bpm', name: 'camunda-external-task-client', version: '7.17.0'
  implementation group: 'org.camunda.bpm.extension.rest', name: 'camunda-rest-client-spring-boot-starter', version: '0.0.4'
  implementation group: 'org.camunda.bpm', name: 'camunda-engine-rest-core', version: '7.17.0'

  implementation group: 'com.fasterxml.jackson.module', name: 'jackson-module-kotlin', version: '2.14.2'
  implementation group: 'com.fasterxml.jackson.datatype', name: 'jackson-datatype-jsr310', version: '2.14.2'
  implementation group: 'org.apiguardian', name: 'apiguardian-api', version: '1.1.1'

  // JAX-B dependencies for JDK 9+
  implementation group: 'javax.xml.bind', name: 'jaxb-api', version: '2.3.1'
  implementation group: 'jakarta.xml.bind', name: 'jakarta.xml.bind-api', version: '4.0.0'
  implementation group: 'org.glassfish.jaxb', name: 'jaxb-runtime', version: '4.0.2'

  implementation group: 'com.launchdarkly', name: 'launchdarkly-java-server-sdk', version: '6.2.1'

  implementation group: 'com.azure', name: 'azure-core', version: '1.41.0'
  implementation group: 'com.azure', name: 'azure-messaging-servicebus', version: '7.14.2'
  implementation group: 'com.microsoft.azure', name: 'azure-servicebus', version: '3.6.7'

  testImplementation group: 'org.mockito', name: 'mockito-core', version: '4.2.0'
  testImplementation group: 'org.mockito', name: 'mockito-junit-jupiter', version: '4.8.1'
  testImplementation group: 'org.mockito', name: 'mockito-inline', version: '4.8.1'

  testAnnotationProcessor group: 'org.projectlombok', name: 'lombok', version: versions.lombok
  testCompileOnly group: 'org.projectlombok', name: 'lombok', version: versions.lombok

  testImplementation libraries.junit5
  testImplementation group: 'org.springframework.boot', name: 'spring-boot-starter-test'

  testImplementation group: 'io.rest-assured', name: 'rest-assured'

  testImplementation group: 'org.springframework.statemachine', name: 'spring-statemachine-test', version: versions.springStatemachine
  testImplementation 'com.github.hmcts:fortify-client:1.3.0:all'
  //pact contract testing
  contractTestImplementation group: 'au.com.dius', name: 'pact-jvm-consumer-junit5_2.12', version: versions.pact
  contractTestImplementation group: 'au.com.dius', name: 'pact-jvm-consumer-java8_2.12', version: versions.pact
  contractTestImplementation group: 'org.hamcrest', name: 'java-hamcrest', version: '2.0.0.0'

  contractTestImplementation('org.junit.jupiter:junit-jupiter-api:5.9.3')
  contractTestImplementation('org.junit.jupiter:junit-jupiter-engine:5.9.3')

  contractTestImplementation sourceSets.main.runtimeClasspath
  contractTestImplementation sourceSets.test.runtimeClasspath

  integrationTestImplementation sourceSets.main.runtimeClasspath
  integrationTestImplementation sourceSets.test.runtimeClasspath

}

mainClassName = 'uk.gov.hmcts.reform.civil.Application'

bootJar {
  getArchiveFileName().set(provider {
    'civil-service.jar'
  })

  manifest {
    attributes('Implementation-Version': project.version.toString())
  }
}

wrapper {
  distributionType = Wrapper.DistributionType.ALL
}

task runAndPublishConsumerPactTests(type: Test){
  logger.lifecycle("Runs pact Tests")
  testClassesDirs = sourceSets.contractTest.output.classesDirs
  classpath = sourceSets.contractTest.runtimeClasspath

}

runAndPublishConsumerPactTests.dependsOn contract

runAndPublishConsumerPactTests.finalizedBy pactPublish

project.ext {
  pactVersion = getCheckedOutGitCommitHash()
}

pact {
  publish {
    pactDirectory = 'target/pacts'
    pactBrokerUrl = System.getenv("PACT_BROKER_FULL_URL") ?: 'https://pact-broker.platform.hmcts.net/'
    if(pactBrokerUrl == 'https://civil-claims.pactflow.io/') {
      excludes = ['civil_service-Idam_api']
      pactBrokerToken = System.getenv("PACT_BROKER_TOKEN")
    }
    tags = [System.getenv("PACT_BRANCH_NAME") ?: getCheckedOutGitCommitHash(), 'latest']
    version = project.pactVersion
  }
}

def getCheckedOutGitCommitHash() {
  'git rev-parse --verify --short HEAD'.execute().text.trim()
}