build.gradle

plugins {
  id 'application'
  id 'pmd'
  id 'org.sonarqube' version '4.0.0.2929'
  id 'jacoco'
  id 'info.solidsoft.pitest' version '1.9.11'
  id 'io.spring.dependency-management' version '1.0.12.RELEASE'
  id 'org.springframework.boot' version '2.5.15'
  id 'uk.gov.hmcts.java' version '0.12.12'
  id 'org.owasp.dependencycheck' version '9.0.6'
  id 'com.github.ben-manes.versions' version '0.46.0'
}

group = 'uk.gov.hmcts.reform'
version = '0.0.1'

java {
  toolchain {
    languageVersion = JavaLanguageVersion.of(17)
  }
}

sourceSets {
  functionalTest {
    java {
      compileClasspath += main.output
      runtimeClasspath += main.output
      srcDir file('src/functionalTest/java')
    }
    resources.srcDir file('src/functionalTest/resources')
  }

  integrationTest {
    java {
      compileClasspath += main.output
      runtimeClasspath += main.output
      srcDir file('src/integrationTest/java')
    }
    resources.srcDir file('src/integrationTest/resources')
  }

  smokeTest {
    java {
      compileClasspath += main.output
      runtimeClasspath += main.output
      srcDir file('src/smokeTest/java')
    }
    resources.srcDir file('src/smokeTest/resources')
  }
}

dependencies {
  integrationTestImplementation(sourceSets.test.output)
  functionalTestImplementation(sourceSets.test.output)
}

tasks.withType(Copy).all { duplicatesStrategy 'warn' }

tasks.withType(JavaCompile) {
  options.compilerArgs << "-Xlint:unchecked" << "-Werror"
}

task functional(type: Test, description: 'Runs the functional tests.', group: 'Verification') {
  testClassesDirs = sourceSets.functionalTest.output.classesDirs
  classpath = sourceSets.functionalTest.runtimeClasspath
}

task integration(type: Test, description: 'Runs the integration tests.', group: 'Verification') {
  testClassesDirs = sourceSets.integrationTest.output.classesDirs
  classpath = sourceSets.integrationTest.runtimeClasspath
}

task smoke(type: Test, description: 'Runs Smoke Tests.') {
  testClassesDirs = sourceSets.smokeTest.output.classesDirs
  classpath = sourceSets.smokeTest.runtimeClasspath
}

task fortifyScan(type: JavaExec)  {
  main = "uk.gov.hmcts.fortifyclient.FortifyClientMainApp"
  classpath += sourceSets.test.runtimeClasspath
  jvmArgs = ['--add-opens=java.base/java.lang.reflect=ALL-UNNAMED']
}

pmd {
  toolVersion = "6.55.0"
  ignoreFailures = true
  sourceSets = [sourceSets.main, sourceSets.test, sourceSets.functionalTest, sourceSets.integrationTest, sourceSets.smokeTest]
  reportsDir = file("$project.buildDir/reports/pmd")
  ruleSetFiles = files("config/pmd/ruleset.xml")
}

jacocoTestReport {
  executionData(test, integration)
  reports {
    xml.enabled = true
    csv.enabled = false
    xml.destination = file("${project.buildDir}/reports/jacoco/test/jacocoTestReport.xml")
  }
}

dependencyUpdates.resolutionStrategy {
  componentSelection { rules ->
    rules.all {
      def isNonStable = { String version ->
        def stableKeyword = ['RELEASE', 'FINAL', 'GA'].any { qualifier -> version.toUpperCase().contains(qualifier) }
        def regex = /^[0-9,.v-]+(-r)?$/
        return !stableKeyword && !(version ==~ regex)
      }
      if (isNonStable(candidate.version) && !isNonStable(currentVersion)) {
        selection.reject('Release candidate')
      }
    }
  }
}

// https://jeremylong.github.io/DependencyCheck/dependency-check-gradle/configuration.html
dependencyCheck {
  // Specifies if the build should be failed if a CVSS score above a specified level is identified.
  // range of 7-10 fails the build, anything lower and it doesn't fail the build
  failBuildOnCVSS = System.getProperty('dependencyCheck.failBuild') == 'true' ? 7.0 : 11
  suppressionFile = 'config/owasp/suppressions.xml'
  nvd.validForHours = 24 // on Jenkins we have 24, so if you get more vulnerabilities locally, try to normalize this value with Jenkins

  analyzers {
    retirejs {
      enabled = false
    }
    ossIndex {
      enabled = false
    }
  }
}

repositories {
  mavenLocal()

  mavenCentral()

  // jitpack should be last resort
  // see: https://github.com/jitpack/jitpack.io/issues/1939
  maven { url 'https://jitpack.io' }
  maven {
    url 'https://repo.spring.io/libs-milestone'
  }
}
project.tasks['pitest'].group = "Verification"

pitest {
  targetClasses = ['uk.gov.hmcts.reform.sscs.*']
  excludedClasses = [
    'uk.gov.hmcts.reform.sscs.config.*',
    'uk.gov.hmcts.reform.sscs.bulkscancore.domain.*',
    'uk.gov.hmcts.reform.sscs.domain.*',
    'uk.gov.hmcts.reform.sscs.BulkScanApplication'
  ]
  threads = 10
  outputFormats = ['XML', 'HTML']
  timestampedReports = false
  mutationThreshold = 90
}

task installLocalGitHook(type: Copy) {
  from new File(rootProject.rootDir, 'config/git/pre-commit')
  into { new File(rootProject.rootDir, '.git/hooks')}
  fileMode 0775
}

compileJava.dependsOn installLocalGitHook

task runGitPreCommitTasks {
  dependsOn 'test'
  dependsOn 'pmdMain'
  dependsOn 'pmdTest'
  dependsOn 'dependencyCheckAggregate'
  dependsOn 'checkstyleMain'
  dependsOn 'checkstyleTest'
}

project.tasks['sonarqube'].dependsOn test, integration, jacocoTestReport
check.dependsOn integration
checkstyleMain.shouldRunAfter(compileJava)
test.shouldRunAfter(checkstyleTest)
integration.shouldRunAfter(checkstyleIntegrationTest)
integration.shouldRunAfter(test)

sonarqube {
  properties {
    property "sonar.projectName", "SSCS - Bulk Scan"
    property "sonar.projectKey", "sscs-bulk-scan"
    property "sonar.coverage.jacoco.xmlReportPaths", "${project.buildDir}/reports/jacoco/test/jacocoTestReport.xml"
    property "sonar.exclusions", "src/main/java/uk/gov/hmcts/reform/sscs/domain/**," +
      "src/main/java/uk/gov/hmcts/reform/sscs/bulkscancore/domain/**," +
      "src/main/java/uk/gov/hmcts/reform/sscs/BulkScanApplication.java," +
      "src/main/java/uk/gov/hmcts/reform/sscs/domain/**," +
      "src/main/java/uk/gov/hmcts/reform/sscs/config/**,"
    property "sonar.pitest.mode", "reuseReport"
    property "sonar.pitest.reportsDirectory", "build/reports/pitest"
  }
}

dependencies {
  implementation group: 'org.springframework.boot', name: 'spring-boot-starter-web', version: springBoot.class.package.implementationVersion
  implementation group: 'org.springframework.boot', name: 'spring-boot-starter-actuator', version: springBoot.class.package.implementationVersion
  implementation group: 'org.springframework.boot', name: 'spring-boot-starter-aop', version: springBoot.class.package.implementationVersion
  implementation group: 'org.springframework.boot', name: 'spring-boot-starter-validation', version: springBoot.class.package.implementationVersion

  // https://mvnrepository.com/artifact/org.springframework.retry/spring-retry
  implementation group: 'org.springframework.retry', name: 'spring-retry', version: '1.3.4'

  implementation group: 'me.xdrop', name: 'fuzzywuzzy', version: '1.4.0'
  implementation group: 'io.rest-assured', name: 'rest-assured', version: '5.4.0'
  implementation group: 'io.rest-assured', name: 'json-path', version: '5.4.0'
  implementation group: 'io.rest-assured', name: 'xml-path', version: '5.4.0'
  implementation group: 'io.github.openfeign', name: 'feign-jackson', version: '13.2.1'
  implementation group: 'com.github.everit-org.json-schema', name: 'org.everit.json.schema', version: '1.14.2'
  implementation group: 'javax.validation', name: 'validation-api', version: '2.0.1.Final'
  implementation group: 'org.elasticsearch', name: 'elasticsearch', version: '7.17.9'

  implementation group: 'io.springfox', name: 'springfox-swagger2', version: '3.0.0'
  implementation group: 'io.springfox', name: 'springfox-swagger-ui', version: '3.0.0'

  implementation group: 'net.logstash.logback', name: 'logstash-logback-encoder', version: '7.0.1'

  implementation group: 'com.github.hmcts', name: 'properties-volume-spring-boot-starter', version: '0.1.0'
  implementation group: 'com.github.hmcts', name: 'java-logging', version: '6.0.1'
  implementation group: 'com.github.hmcts', name: 'ccd-client', version: '4.8.6'

  implementation group: 'com.github.hmcts', name: 'service-auth-provider-java-client', version: '4.0.3'

  implementation group: 'com.github.hmcts', name: 'sscs-common', version: '5.3.0'

  implementation group: 'com.microsoft.azure', name: 'applicationinsights-logging-logback', version: '2.6.3'
  implementation group: 'com.microsoft.azure', name: 'applicationinsights-spring-boot-starter', version: '2.6.3'

  implementation group: 'org.apache.commons', name: 'commons-collections4', version: '4.4'
  implementation group: 'org.apache.commons', name: 'commons-text', version: '1.10.0'

  implementation group: 'org.projectlombok', name: 'lombok', version: '1.18.26'
  annotationProcessor group: 'org.projectlombok', name: 'lombok', version: '1.18.26'

  testImplementation group: 'org.projectlombok', name: 'lombok', version: '1.18.26'
  testAnnotationProcessor group: 'org.projectlombok', name: 'lombok', version: '1.18.26'
  testImplementation group: 'com.github.hmcts', name: 'fortify-client', version: '1.2.2', classifier: 'all'
  testImplementation group: 'com.h2database', name: 'h2', version: '2.1.214'

  functionalTestImplementation group: 'org.projectlombok', name: 'lombok', version: '1.18.26'
  functionalTestAnnotationProcessor group: 'org.projectlombok', name: 'lombok', version: '1.18.26'

  testImplementation(group: 'org.springframework.boot', name: 'spring-boot-starter-test', version: springBoot.class.package.implementationVersion) {
    exclude group: "com.vaadin.external.google", module: "android-json"
  }

  testImplementation group: 'pl.pragmatists', name: 'JUnitParams', version: '1.1.1'
  testImplementation group: 'net.javacrumbs.json-unit', name: 'json-unit-assertj', version: '2.36.1'
  testImplementation group: 'org.pitest', name: 'pitest', version: '1.11.7'
  testImplementation group: 'info.solidsoft.gradle.pitest', name: 'gradle-pitest-plugin', version: '1.9.11'
  testImplementation group: 'org.codehaus.sonar-plugins', name: 'sonar-pitest-plugin', version: '0.5'
  testImplementation group: 'com.github.tomakehurst', name: 'wiremock-jre8', version: '2.35.0', {
      exclude group: 'junit', module: 'junit'
  }
  testImplementation group: 'com.typesafe', name: 'config', version: '1.4.2'
  testImplementation group: 'junit', name: 'junit', version: '4.13.2'
  testRuntimeOnly group: 'org.junit.vintage', name: 'junit-vintage-engine', version: '5.9.2'
  testImplementation group: 'org.apiguardian', name: 'apiguardian-api', version: '1.1.2'

  integrationTestImplementation(group: 'org.springframework.cloud', name: 'spring-cloud-contract-wiremock', version: '3.1.6') {
    exclude group: "com.github.tomakehurst", module: "wiremock-standalone"
  }

  integrationTestImplementation sourceSets.main.runtimeClasspath
  integrationTestImplementation sourceSets.test.runtimeClasspath

  functionalTestImplementation sourceSets.main.runtimeClasspath
  functionalTestImplementation sourceSets.test.runtimeClasspath

  smokeTestImplementation sourceSets.main.runtimeClasspath
  smokeTestImplementation sourceSets.test.runtimeClasspath
}

dependencyManagement {
  dependencies {

    dependency group: 'commons-beanutils', name: 'commons-beanutils', version: '1.9.4'

    dependency group: 'org.apache.logging.log4j', name: 'log4j-api', version: '2.20.0'
    dependency group: 'org.apache.logging.log4j', name: 'log4j-to-slf4j', version: '2.20.0'

    //CVE-2021-40690
     dependency group: 'org.apache.santuario', name: 'xmlsec', version: '3.0.1'

    // CVE-2019-0232, CVE-2019-0199 - command line injections on windows
    dependencySet(group: 'org.apache.tomcat.embed', version: '10.1.19') {
      entry 'tomcat-embed-core'
      entry 'tomcat-embed-el'
      entry 'tomcat-embed-websocket'
    }

    //to remove CVE-2020-8908
    dependencySet(group: 'com.google.guava', version: '32.1.0-jre') {
      entry 'guava'
    }

    //CVE-2021-22112
    dependencySet(group: 'org.springframework.security', version: '5.7.10') {
      entry 'spring-security-crypto'
    }

    //CVE-2021-27807
    dependencySet(group: 'org.apache.pdfbox', version: '2.0.27') {
      entry 'pdfbox'
    }

    dependencySet(group: 'org.apache.xmlgraphics', version: '1.16') {
      entry 'batik-all'
    }

    dependencySet(group: 'org.apache.commons', version: '1.22') {
      entry 'commons-compress'
    }

    dependencySet(group: 'org.yaml', version: '1.33') {
      entry 'snakeyaml'
    }

    //CVE-2021-22118
    dependencySet(group: 'org.springframework', version: '5.3.28') {
      entry 'spring-aop'
      entry 'spring-aspects'
      entry 'spring-beans'
      entry 'spring-context'
      entry 'spring-context-support'
      entry 'spring-core'
      entry 'spring-expression'
      entry 'spring-jcl'
      entry 'spring-jdbc'
      entry 'spring-orm'
      entry 'spring-tx'
      entry 'spring-web'
      entry 'spring-webmvc'
    }

    //CVE-2021-27568
    dependencySet(group: 'net.minidev', version: '2.4.10') {
      entry 'json-smart'
    }

    dependencySet(group: 'net.minidev', version: '2.4.9') {
      entry 'accessors-smart'
    }

    imports {
      mavenBom "org.springframework.cloud:spring-cloud-dependencies:2020.0.6"
    }
    //CVE-2021-28170
    dependency group: 'org.glassfish', name: 'jakarta.el', version: '4.0.2'

    //CVE-2020-36518, CVE-2022-42004
    dependencySet(group: 'com.fasterxml.jackson.core', version: '2.14.3') {
        entry 'jackson-databind'
        entry 'jackson-core'
        entry 'jackson-annotations'
    }
  }
}

run {
  def debug = System.getProperty("debug")
  if (debug == 'true') {
    jvmArgs = ['-agentlib:jdwp=transport=dt_socket,server=y,suspend=y,address=5005']
  }
}

mainClassName = 'uk.gov.hmcts.reform.sscs.BulkScanApplication'

tasks.withType(Test) {
  useJUnitPlatform()
}

bootJar {
  archiveName = 'sscs-bulk-scan.jar'

  manifest {
    attributes('Implementation-Version': project.version.toString())
  }
}