build.gradle

apply from: "$rootDir/gradle/jacoco.gradle"
apply from: "$rootDir/gradle/maven.gradle"
apply from: "$rootDir/gradle/checkstyle.gradle"
apply from: "$rootDir/gradle/javadoc.gradle"

tasks.named('compileJava', JavaCompile).configure {
    options.release = 8
}

// Force Eclipse use Java 1.8, otherwise it will get Java 17 (!) from gradle
eclipse {
  jdt {
    sourceCompatibility = 8
    targetCompatibility = 8
    javaRuntimeName = "JavaSE-1.8"
  }
}

configurations {
  // used only in distribution. It is not listed in pom.xml, so users like maven plugin don't use this dependency.
  logBinding
  // used to make sure Eclipse config can see apple library during compilation
  appleExtensions
}

sourceSets {
  main {
    java {
      exclude '**/*.properties'
      exclude '**/*.db'
      exclude '**/*.html'
      exclude '**/*.png'
    }
    resources {
      /*
       * Because why put everything in a single folder when you can split it
       * and mix it with other files you don't actually need together
      */
      srcDirs = ['src/xsl', 'etc', 'src/main/java']
      include '*.xsd'
      include 'bugrank.txt'
      include 'findbugs.xml'
      include 'messages*.xml'
      include '**/*.properties'
      exclude 'doc.properties'
      exclude 'script.properties'
      include '*.xsl'
      include '**/*.db'
      include 'CWE_4.10.json'
    }
  }
  gui {
    java {
      srcDirs = ['src/gui/main']
    }
    resources {
      srcDirs = ['src/gui/main']
      include '**/*.html'
      include '**/*.png'
    }
  }
}

dependencies {
  api libs.asm
  api libs.asm.analysis
  api libs.asm.commons
  api libs.asm.tree
  api libs.asm.util
  api 'org.apache.bcel:bcel:6.6.1'
  api 'com.github.stephenc.jcip:jcip-annotations:1.0-1'
  api('org.dom4j:dom4j:2.1.4') {
    // exclude transitive dependencies to keep compatible with dom4j 2.1.1
    // https://github.com/dom4j/dom4j/issues/85
    // https://docs.gradle.org/current/userguide/dependency_downgrade_and_exclude.html#sec:excluding-transitive-deps
    exclude group: 'jaxen',            module: 'jaxen'
    exclude group: 'javax.xml.stream', module: 'stax-api'
    exclude group: 'net.java.dev.msv', module: 'xsdlib'
    exclude group: 'javax.xml.bind',   module: 'jaxb-api'
    exclude group: 'pull-parser',      module: 'pull-parser'
    exclude group: 'xpp3',             module: 'xpp3'
  }
  implementation 'jaxen:jaxen:2.0.0' // only transitive through org.dom4j:dom4j:2.1.4, which has an *optional* dependency on jaxen:jaxen.
  api 'org.apache.commons:commons-lang3:3.13.0'
  api 'org.apache.commons:commons-text:1.10.0'
  api 'org.slf4j:slf4j-api:2.0.9'
  implementation 'net.sf.saxon:Saxon-HE:12.3'
  implementation libs.log4j.core
  logBinding (libs.log4j.slf4j2.impl) {
    exclude group: 'org.slf4j'
  }

  // These annotations are repackaged to spotbugs.jar, to keep backward compatibility for Ant task.
  // If they're not repackaged, Ant task will report 'java.lang.ClassNotFoundException: edu.umd.cs.findbugs.annotations.CleanupObligation'
  api project(':spotbugs-annotations')

  api "com.google.code.gson:gson:2.10.1"

  guiImplementation sourceSets.main.runtimeClasspath
  guiCompileOnly 'com.apple:AppleJavaExtensions:1.4'
  guiCompileOnly project(':spotbugs-annotations')

  // for Eclipse compilation only
  appleExtensions 'com.apple:AppleJavaExtensions:1.4'
}

clean {
  delete ".libs"
}

tasks.named('compileGuiJava', JavaCompile).configure {
  options.release = 8
}

tasks.withType(Jar).configureEach {
  includeEmptyDirs = false
  // FIXME: this is ugly, but is what ant is currently doing... our own jars are included as dependencies :S
  //destinationDir = file("$projectDir/lib")
}

eclipse.classpath.file {
    whenMerged {
      classpath ->
         classpath.entries.removeAll { entry -> entry.kind == 'lib' && entry.path.contains('build/classes/')}
         classpath.entries.removeAll { entry -> entry.kind == 'lib' && entry.path.contains('build/resources/')}
         classpath.entries.removeAll { entry -> entry.kind == 'lib' && entry.path.contains('xml-apis')}
         classpath.entries.forEach {
             entry ->
               if(entry.kind == 'lib' && !entry.path.contains('spotbugs-annotations')
                   && !java.nio.file.Files.isDirectory(java.nio.file.Paths.get(entry.path))) {
                   entry.path = ".libs/" + java.nio.file.Paths.get(entry.path).getFileName().toString()
                   entry.exported = true
               }
         }
         Map entryByPath = classpath.entries.groupBy { entry -> entry.path }
         entryByPath.each { key, values ->
          if (values.size() > 1) {
            def entry = values.first()
            if (entry.kind == 'src') {
              entry.includes = []
              entry.excludes = []
            }
            int index = classpath.entries.indexOf entry
            logger.lifecycle "Removing ${values.collect { it.path }}"
            classpath.entries.removeAll values
            logger.lifecycle "Adding ${entry.path}"
            classpath.entries.add index, entry
          }
        }
    }
}

def updateManifest = tasks.register('updateManifest') {
  inputs.file "$projectDir/META-INF/MANIFEST-TEMPLATE.MF"
  outputs.file "$projectDir/META-INF/MANIFEST.MF"
  dependsOn configurations.runtimeClasspath
  doLast {
    def manifestSpec = manifest {
      from "$projectDir/META-INF/MANIFEST-TEMPLATE.MF"
      attributes 'Main-Class': 'edu.umd.cs.findbugs.LaunchAppropriateUI',
               'Bundle-Version': project.version.replace('-', '.'),
               'Bundle-ClassPath': 'spotbugs.jar,' +  configurations.runtimeClasspath.collect { it.name }.join(',')
    }
    // write manifests
    manifestSpec.writeTo("$projectDir/META-INF/MANIFEST.MF")
  }
}
tasks.eclipse.dependsOn(updateManifest)

// Manually define what goes into the default jar, since it's not only main sourceset
def jar = tasks.named('jar', Jar) {
  // To keep backward compatibility, delete version number from jar name
  archiveFileName = "${archiveBaseName.get()}.${archiveExtension.get()}"

  from sourceSets.main.output
  from sourceSets.gui.output
  def jarInClasspath = project.configurations.runtimeClasspath + project.configurations.logBinding
  manifest {
    attributes 'Main-Class': 'edu.umd.cs.findbugs.LaunchAppropriateUI',
               'Bundle-Version': project.version,
               'Class-Path': project.providers.provider { jarInClasspath.collect{it.getName()}.join(' ') + ' config/' }
  }
}
tasks.spotbugsMain.dependsOn(jar)
tasks.spotbugsGui.dependsOn(jar)

// Populate bin folder with scripts
def scripts = tasks.register('scripts', Copy) {
  // Take the properties into account for up-to-date checking
  inputs.file "$projectDir/etc/script.properties"

  def props = new Properties()
  doFirst {
    props.load(new FileInputStream("$projectDir/etc/script.properties"))

    filesNotMatching('**/*.ico') {
      filter(org.apache.tools.ant.filters.ReplaceTokens, tokens: [
        'GET_FBHOME': props.getProperty('script.get.fbhome'),
        'SET_DEFAULT_JAVA': props.getProperty('script.set.default.java'),
        'WRAP_JAVA': props.getProperty('script.wrap.java'),
        'WRAP_JAR': props.getProperty('script.wrap.jar'),
        'DEFINE_ESCAPE_ARG': props.getProperty('script.define.escape_arg')])
    }
  }

  from 'src/scripts/standard'
  from 'src/scripts/windows'
  from('src/scripts/deprecated') {
    into 'deprecated'
  }
  from('src/scripts/experimental') {
    into 'experimental'
  }

  destinationDir file("$buildDir/bin")
  duplicatesStrategy DuplicatesStrategy.FAIL
  fileMode 0755
}

// This disables hundreds of javadoc warnings on missing tags etc, see #340
javadoc {
  doFirst {
    // This is supposed to enable everything except "missing" but doesn't work with gradle
    // See http://docs.oracle.com/javase/8/docs/technotes/tools/unix/javadoc.html
    options.addBooleanOption('Xdoclint:all,-missing', true)

    // TODO remove command and warning below if the doclint can be properly configured
    options.addStringOption('Xmaxwarns', '3')
  }
  doLast {
    logger.warn('Javadoc: too many warnings, only first 3 are shown, see #340!')
  }
}

java {
  withJavadocJar()
  withSourcesJar()
}

apply plugin: 'distribution'
distributions {
  main {
    contents {
      from(scripts) {
        into 'bin'
      }
      from 'README.txt'
      from ('plugin') {
         into 'plugin'
         include 'README'
      }
      from 'licenses'
      from([configurations.runtimeClasspath, configurations.logBinding]) {
        into 'lib'
        include '**/*.jar'
      }
      from([jar, project(':spotbugs-ant').jar]) {
        into 'lib'
      }
      from ('log4j2.xml') {
        into 'lib/config'
      }
      from('src/xsl') {
        into 'src/xsl'
        include '**/*.xsl'
      }
    }
  }
}

tasks.named('distTar', Tar) {
  compression = Compression.GZIP
  duplicatesStrategy = DuplicatesStrategy.FAIL
}
def distZip = tasks.named('distZip', Zip) {
  duplicatesStrategy = DuplicatesStrategy.FAIL
  fileMode 0755
}
tasks.named('jar') {
  dependsOn tasks.named('updateManifest')
}

def distSrcZip = tasks.register('distSrcZip', Exec) {
  def out = "${buildDir}/distributions/spotbugs-${project.version}-source.zip"
  outputs.file out
  commandLine 'git', 'archive', '-o', out,
    '--prefix', "spotbugs-${project.version}/", 'HEAD'

  onlyIf {
    file("$rootDir/.git").isDirectory()
  }
}
def assembleDist = tasks.named('assembleDist') {
  finalizedBy distSrcZip
}
tasks.named('assemble') {
  dependsOn assembleDist
}

def unzipDist = tasks.register('unzipDist', Copy) {
  dependsOn distZip
  from distZip.map { zipTree(it.outputs.files.singleFile) }
  into file("$buildDir/smoketest/")
  // Remove prefix
  eachFile { details ->
    details.path = details.path - "spotbugs-${project.version}"
  }
}

// TODO : actually check the output beyond it not blowing up in pieces?
def smokeTest = tasks.register('smokeTest') {
  dependsOn unzipDist, project(':spotbugs-ant').tasks.named('jar')
  doLast {
    ant.taskdef(name:'spotbugs', classname:'edu.umd.cs.findbugs.anttask.FindBugsTask', classpath:project(':spotbugs-ant').jar.outputs.files.asPath)
    ant.spotbugs(home:"$buildDir/smoketest/", output:'xml:withMessages',
              jvmargs:'-ea -Xmx1200m',
              excludeFilter:'findbugsExclude.xml',
              projectName:'spotbugs',
              maxRank:'20',
              timeout:'1800000',
              outputFile:"${buildDir}/smoketest/findbugscheckAll.xml") {
      sourcePath(path:'src/main/java:src/gui/main:src/tools')
      'class'(location:project.tasks['compileJava'].destinationDir)
      configurations.compileClasspath.each { File file -> auxClasspath(path:file.path) }
    }
  }
}

publishing.publications.maven {
  artifact distTar
  artifact distZip
  pom {
    name = 'SpotBugs'
    description = "SpotBugs: Because it's easy!"
  }
}

// Module name should be reverse-DNS (com.github.spotbugs) just like package name
// http://blog.joda.org/2017/04/java-se-9-jpms-module-naming.html
ext.moduleName = 'com.github.spotbugs.spotbugs'
apply from: "$rootDir/gradle/jigsaw.gradle"

tasks.named('spotbugsTest').configure {
  ignoreFailures = true
}

dependencies {
  constraints {
    logBinding("org.apache.logging.log4j:log4j-core") {
      version {
        strictly("[2.17.1, 3[")
        prefer("2.20.0")
      }
      because("CVE-2021-44228, CVE-2021-45046, CVE-2021-45105, CVE-2021-44832: Log4j vulnerable to remote code execution and other critical security vulnerabilities")
    }
    logBinding("ch.qos.logback:logback-core") {
      version {
        strictly("[1.2.9, 2[")
        prefer("1.4.11")
      }
      because("CVE-2021-42550: Logback vulnerable to remote code execution vulnerabilities")
    }
  }
}

// TODO : generatemanual (we should decide what to do with the manual)
// TODO : generatepdfmanual
// TODO : bugdesc

// Smoke testing
// TODO : plugincheck_fbcontrib
// TODO : spotbugsTestCases (already analyzed by unit tests... not particularly useful, is it?)

// Integration testing
// TODO : validatesamplehtmloutput (really?)
// TODO : validatesamplexmloutput

// XML validation
// TODO : validate