build.gradle

plugins {
  id 'application'
  id 'pmd'
  id 'jacoco'
  id 'io.spring.dependency-management' version '1.0.11.RELEASE'
  id 'uk.gov.hmcts.java' version '0.12.12'
  id 'org.springframework.boot' version '2.3.5.RELEASE'
  id 'com.github.ben-manes.versions' version '0.39.0'
  id 'org.owasp.dependencycheck' version '8.0.2'
  id 'org.sonarqube' version '3.3'
  id "info.solidsoft.pitest" version '1.7.0'
}

group = 'uk.gov.hmcts.reform'
version = '0.0.1'

sourceCompatibility = 11
targetCompatibility = 11

sourceSets {
  functionalTest {
    java {
      compileClasspath += main.output
      runtimeClasspath += main.output
      srcDir file('src/functionalTest/java')
    }
    resources.srcDir file('src/functionalTest/resources')
  }

  integrationTest {
    java {
      compileClasspath += main.output
      runtimeClasspath += main.output
      srcDir file('src/integrationTest/java')
    }
    resources.srcDir file('src/integrationTest/resources')
  }

  smokeTest {
    java {
      compileClasspath += main.output
      runtimeClasspath += main.output
      srcDir file('src/smokeTest/java')
    }
    resources.srcDir file('src/smokeTest/resources')
  }
}

tasks.withType(Copy).all { duplicatesStrategy 'warn' }

tasks.withType(JavaCompile) {
  options.compilerArgs << "-Xlint:unchecked" << "-Werror"
}

task functional(type: Test, description: 'Runs the functional tests.', group: 'Verification') {
  testClassesDirs = sourceSets.functionalTest.output.classesDirs
  classpath = sourceSets.functionalTest.runtimeClasspath
}

task integration(type: Test, description: 'Runs the integration tests.', group: 'Verification') {
  testClassesDirs = sourceSets.integrationTest.output.classesDirs
  classpath = sourceSets.integrationTest.runtimeClasspath

  // set your environment variables here
  // environment("APPINSIGHTS_INSTRUMENTATIONKEY", "test-key")
}

task smoke(type: Test) {
  description = "Runs Smoke Tests"
  testClassesDirs = sourceSets.smokeTest.output.classesDirs
  classpath = sourceSets.smokeTest.runtimeClasspath
}

task fortifyScan(type: JavaExec)  {
  main = "uk.gov.hmcts.fortifyclient.FortifyClientMainApp"
  classpath += sourceSets.test.runtimeClasspath
  jvmArgs = ['--add-opens=java.base/java.lang.reflect=ALL-UNNAMED']
}

pmd {
  toolVersion = "6.9.0"
  ignoreFailures = true
  sourceSets = [sourceSets.main, sourceSets.test, sourceSets.functionalTest, sourceSets.integrationTest, sourceSets.smokeTest]
  reportsDir = file("$project.buildDir/reports/pmd")
  ruleSetFiles = files("config/pmd/ruleset.xml")
}

jacocoTestReport {
  executionData(test, integration)
  reports {
    xml.enabled = true
    csv.enabled = false
    xml.destination file("${buildDir}/reports/jacoco/test/jacocoTestReport.xml")
  }
}

pitest {
  targetClasses = ['uk.gov.hmcts.reform.sscs.service.*',
                   'uk.gov.hmcts.reform.sscs.exception.*',
                   'uk.gov.hmcts.reform.sscs.controllers.*']
  excludedClasses = ['uk.gov.hmcts.reform.sscs.config.*',
                     'uk.gov.hmcts.reform.sscs.domain.*',
                     'uk.gov.hmcts.reform.sscs.servicebus.*']
  excludedMethods = ['equals', 'hashcode']
  jvmArgs = ['-Xms1G', '-Xmx3G']
  enableDefaultIncrementalAnalysis = true
  historyInputLocation = 'build/reports/pitest/fastermutationtesting'
  historyOutputLocation = 'build/reports/pitest/fastermutationtestingoutput'
  threads = 20
  verbose = true
  outputFormats = ['XML', 'HTML']
  timestampedReports = false
  mutationThreshold = 75
}

task installLocalGitHook(type: Copy) {
  from new File(rootProject.rootDir, 'config/git/pre-commit')
  into { new File(rootProject.rootDir, '.git/hooks')}
  fileMode 0775
}

compileJava.dependsOn installLocalGitHook

task runGitPreCommitTasks {
  dependsOn 'test'
  dependsOn 'pmdMain'
  dependsOn 'pmdTest'
  dependsOn 'dependencyCheckAggregate'
  dependsOn 'checkstyleMain'
  dependsOn 'checkstyleTest'
}

project.tasks['sonarqube'].dependsOn test, integration, jacocoTestReport
check.dependsOn integration
checkstyleMain.shouldRunAfter(compileJava)
test.shouldRunAfter(checkstyleTest)
integration.shouldRunAfter(checkstyleIntegrationTest)
integration.shouldRunAfter(test)
functional.shouldRunAfter(checkstyleIntegrationTest)
functional.shouldRunAfter(test)

sonarqube {
  properties {
    property "sonar.projectName", "SSCS - CCD Callback Orchestrator"
    property "sonar.projectKey", "uk.gov.hmcts.reform:sscs-ccd-callback-orchestrator"
    property "sonar.coverage.jacoco.xmlReportPaths", "${project.buildDir}/reports/jacoco/test/jacocoTestReport.xml"
    property "sonar.exclusions", "src/main/java/uk/gov/hmcts/reform/sscs/domain/**," +
      "src/main/java/uk/gov/hmcts/reform/sscs/Application.java," +
      "src/main/java/uk/gov/hmcts/reform/sscs/domain/**," +
      "src/main/java/uk/gov/hmcts/reform/sscs/config/**,"
    property "sonar.host.url", "https://sonar.reform.hmcts.net/"
    property "sonar.pitest.mode", "reuseReport"
    property "sonar.pitest.reportsDirectory", "build/reports/pitest"
  }
}

dependencyUpdates.resolutionStrategy {
  componentSelection { rules ->
    rules.all {
      def isNonStable = { String version ->
        def stableKeyword = ['RELEASE', 'FINAL', 'GA'].any { qualifier -> version.toUpperCase().contains(qualifier) }
        def regex = /^[0-9,.v-]+(-r)?$/
        return !stableKeyword && !(version ==~ regex)
      }
      if (isNonStable(candidate.version) && !isNonStable(currentVersion)) {
        selection.reject('Release candidate')
      }
    }
  }
}

// https://jeremylong.github.io/DependencyCheck/dependency-check-gradle/configuration.html
dependencyCheck {
  // Specifies if the build should be failed if a CVSS score above a specified level is identified.
  // range of 7-10 fails the build, anything lower and it doesn't fail the build
  failBuildOnCVSS = System.getProperty('dependencyCheck.failBuild') == 'true' ? 7.0 : 11
  suppressionFile = 'config/owasp/suppressions.xml'

  cveValidForHours = 24

  analyzers {
      retirejs {
          enabled = false
      }
      ossIndex {
          enabled = false
      }
  }
}

repositories {
  mavenLocal()
  mavenCentral()
  maven {
    url 'https://repo.spring.io/libs-milestone'
  }

  // jitpack should be last resort
  // see: https://github.com/jitpack/jitpack.io/issues/1939
  maven { url 'https://jitpack.io' }
}

dependencyManagement {
  imports {
    mavenBom "org.springframework.cloud:spring-cloud-dependencies:Hoxton.SR12"
  }
  dependencies {
    dependency group: 'commons-beanutils', name: 'commons-beanutils', version: '1.9.4'
    dependency group: 'org.apache.logging.log4j', name: 'log4j-api', version: '2.19.0'
    dependency group: 'org.apache.logging.log4j', name: 'log4j-to-slf4j', version: '2.19.0'

      // CVE-2022-41881, CVE-2022-41915
      dependencySet(group: 'io.netty', version: '4.1.86.Final') {
        entry 'netty-buffer'
        entry 'netty-common'
        entry 'netty-codec'
        entry 'netty-codec-http'
        entry 'netty-handler'
        entry 'netty-resolver'
        entry 'netty-transport'
        entry 'netty-transport-native-epoll'
        entry 'netty-transport-native-kqueue'
        entry 'netty-transport-native-unix-common'
    }

    // CVE-2022-23181 - CVE-2022-23181
    dependencySet(group: 'org.apache.tomcat.embed', version: '10.1.6') {
      entry 'tomcat-embed-core'
      entry 'tomcat-embed-el'
      entry 'tomcat-embed-websocket'
    }

    dependencySet(group: 'com.google.guava', version: '31.1-jre') {
      entry 'guava'
    }

    //CVE-2021-22112
    dependencySet(group: 'org.springframework.security', version: '5.7.1') {
      entry 'spring-security-crypto'
    }

    //CVE-2021-22118
    dependencySet(group: 'org.springframework', version: '5.2.22.RELEASE') {
      entry 'spring-aop'
      entry 'spring-aspects'
      entry 'spring-beans'
      entry 'spring-context'
      entry 'spring-context-support'
      entry 'spring-core'
      entry 'spring-expression'
      entry 'spring-jcl'
      entry 'spring-jdbc'
      entry 'spring-jms'
      entry 'spring-messaging'
      entry 'spring-orm'
      entry 'spring-test'
      entry 'spring-tx'
      entry 'spring-web'
      entry 'spring-webmvc'
    }

    //CVE-2021-29425
    dependencySet(group: 'commons-io', version: '2.11.0') {
      entry 'commons-io'
    }

    //CVE-2022-25857, CVE-2022-38749, CVE-2022-38750, CVE-2022-38751
    dependencySet(group: 'org.yaml', version: '1.33') {
        entry 'snakeyaml'
    }

    //CVE-2021-42550
    dependencySet(group: 'ch.qos.logback', version: '1.2.11') {
        entry 'logback-core'
        entry 'logback-classic'
    }

    // CVE-2019-12086, CVE-2020-36518, CVE-2022-42004
    // remove once spring manager incorporates this changes
    dependencySet(group: 'com.fasterxml.jackson.core', version: '2.14.1') {
        entry 'jackson-databind'
        entry 'jackson-core'
        entry 'jackson-annotations'
    }

    //CVE-2021-28170
    dependency group: 'org.glassfish', name: 'jakarta.el', version: '4.0.2'
  }
}


dependencies {
  implementation group: 'org.springframework.boot', name: 'spring-boot-starter-web'
  implementation group: 'org.springframework.boot', name: 'spring-boot-starter-actuator'
  implementation group: 'org.springframework.boot', name: 'spring-boot-starter-aop'
  implementation group: 'org.springframework.boot', name: 'spring-boot-starter-json'
  implementation group: 'org.springframework.boot', name: 'spring-boot-starter-validation'

  implementation group: 'org.springframework', name: 'spring-jms'

  implementation group: 'org.springframework.retry', name: 'spring-retry', version: '1.3.1'
  implementation group: 'org.springframework.cloud', name: 'spring-cloud-starter-netflix-hystrix', version: '2.2.9.RELEASE'

  implementation group: 'org.apache.qpid', name: 'qpid-jms-client', version: '2.2.0'
  implementation group: 'io.github.openfeign', name: 'feign-jackson', version: '12.1'
  implementation group: 'io.springfox', name: 'springfox-swagger2', version: '3.0.0'

  implementation group: 'com.github.hmcts', name: 'properties-volume-spring-boot-starter', version: '0.1.0'
  implementation group: 'com.github.hmcts', name: 'java-logging', version: '5.1.9'
  implementation group: 'com.github.hmcts', name: 'service-auth-provider-java-client', version: '4.0.3'

  implementation group: 'com.microsoft.azure', name: 'applicationinsights-logging-logback', version: '2.6.3'
  implementation group: 'com.microsoft.azure', name: 'applicationinsights-spring-boot-starter', version: '2.6.3'

  implementation group: 'org.pitest', name: 'pitest', version: '1.4.2'
  implementation group:'info.solidsoft.gradle.pitest', name: 'gradle-pitest-plugin', version: '1.3.0'
  implementation group:'org.codehaus.sonar-plugins', name:'sonar-pitest-plugin', version: '0.5'

  implementation group: 'org.projectlombok', name:'lombok', version: '1.18.24'
  annotationProcessor group: 'org.projectlombok', name:'lombok', version: '1.18.24'

  testImplementation group: 'org.junit.jupiter', name: 'junit-jupiter-api', version: '5.9.1'
  testImplementation group: 'org.junit.jupiter', name: 'junit-jupiter-params', version: '5.9.1'
  testRuntimeOnly group: 'org.junit.jupiter', name: 'junit-jupiter-engine', version: '5.9.1'

  testImplementation group: 'com.github.hmcts', name: 'sscs-common', version: '4.25.1'
  testImplementation group: 'com.github.hmcts', name: 'fortify-client', version: '1.2.2', classifier: 'all'

  testImplementation group: 'org.springframework.boot', name: 'spring-boot-starter-test'
  testImplementation group: 'org.mockito', name: 'mockito-core', version: '4.0.0'
  testImplementation group: 'pl.pragmatists', name: 'JUnitParams', version: '1.1.1'
  testImplementation group: 'org.apache.qpid', name: 'qpid-broker-core', version: '9.0.0'
  testImplementation group: 'org.apache.qpid', name: 'qpid-broker-plugins-amqp-1-0-protocol', version: '9.0.0'
  testImplementation group: 'org.apache.qpid', name: 'qpid-broker-plugins-memory-store', version: '9.0.0'

  integrationTestImplementation sourceSets.main.runtimeClasspath
  integrationTestImplementation sourceSets.test.runtimeClasspath

  functionalTestImplementation sourceSets.main.runtimeClasspath

  functionalTestImplementation sourceSets.test.runtimeClasspath

  smokeTestImplementation sourceSets.main.runtimeClasspath
  smokeTestImplementation sourceSets.test.runtimeClasspath

}

// this is required to force Java running on the Azure Windows Server OS into using
// UTF-8 as the default character set instead of windows-1252 which causes issues
applicationDefaultJvmArgs = ["-Dfile.encoding=UTF-8"]

run {
  def debug = System.getProperty("debug")
  if (debug == 'true') {
    jvmArgs = ['-agentlib:jdwp=transport=dt_socket,server=y,suspend=y,address=5005']
  }
}

mainClassName = 'uk.gov.hmcts.reform.sscs.Application'

bootJar {
  archiveFileName = 'sscs-ccd-callback-orchestrator.jar'

  manifest {
    attributes('Implementation-Version': project.version.toString())
  }
}