build.gradle

import com.github.spotbugs.snom.SpotBugsTask
import com.github.spotbugs.snom.Confidence
import com.github.spotbugs.snom.Effort

plugins {
    // TODO: Since Gradle is not static description but live code, does the
    // ordering of plugins have impact?
    id "java" // Gradle support for Java
    // TODO: #607. How to leverage the Gradle dashboard?
    id "build-dashboard" // See build/reports/buildDashboard/index.html
    // TODO: Leverage the projectReport task for showing in CI
    id "project-report" // Try the `projectReport` task
    alias libs.plugins.com.dorongold.task.tree.plugin
    alias libs.plugins.com.github.ben.manes.versions.plugin
    alias libs.plugins.nl.littlerobots.version.catalog.update.plugin
    id "checkstyle" // To check that code follow style standards
    id "jacoco" // To run test coverage
    id "pmd" // Static analysis based on source (does not check compiled code)
    id "com.github.spotbugs" // Static analysis based on compiled code (does not check source)
    alias libs.plugins.com.diffplug.spotless.plugin
    alias libs.plugins.com.github.andygoossens.gradle.modernizer.plugin
    id "info.solidsoft.pitest" // To run mutation testing
    alias libs.plugins.org.kordamp.gradle.jdeps.plugin
    alias libs.plugins.org.owasp.dependencycheck.plugin
    id "application" // To build the executable jar
}

version = "0-SNAPSHOT"
group = "demo"

repositories {
    mavenCentral()
}

dependencies {
    compileOnly libs.org.projectlombok.lombok
    annotationProcessor libs.org.projectlombok.lombok
    compileOnly libs.com.github.spotbugs.spotbugs.annotations
    compileOnly libs.com.google.code.findbugs.findbugs.annotations
    compileOnly libs.org.gaul.modernizer.maven.annotations

    testCompileOnly libs.org.projectlombok.lombok
    testAnnotationProcessor libs.org.projectlombok.lombok
    testCompileOnly libs.com.google.code.findbugs.findbugs.annotations

    testImplementation libs.org.junit.jupiter.junit.jupiter
    testImplementation libs.org.assertj.assertj.core
    testImplementation libs.org.mockito.mockito.core

    // Quiet build -- build works without this, but JUnit complains
    testRuntimeOnly libs.org.junit.jupiter.junit.jupiter.engine

    spotbugsPlugins "com.h3xstream.findsecbugs:findsecbugs-plugin:$findsecbugsPluginVersion"

    // Give special attention to https://blog.gradle.org/log4j-vulnerability
    // Gradle 7.3.3+ addresses this out of the box. If you are using Gradle
    // <7.3.3 (this project is current), you *must* add this:
    /*
    constraints {
        implementation("org.apache.logging.log4j:log4j-core") {
            version {
                strictly("[2.17, 3[")
                prefer("2.17.1")
            }
            because("CVE-2021-44228, CVE-2021-45046, CVE-2021-45105: Log4j vulnerable to remote code execution and other critical security vulnerabilities")
        }
    }
    */
    // Give special attention to a BCEL CVE triggered by Spotbugs
    // You only need this if you are not on a recent SpotBugs version
    constraints {
        spotbugs("org.apache.bcel:bcel") {
            version {
                strictly("[6.7.0, 7[")
            }
            because("CVE-2022-42920: BCEL out-of-bounds but can create arbitrary bytecode")
        }
    }
}

sourceSets {
    integrationTest {
        compileClasspath += sourceSets.main.output
        compileClasspath += sourceSets.test.output
        runtimeClasspath += sourceSets.main.output
        runtimeClasspath += sourceSets.test.output
    }
}

configurations {
    integratrationTestAnnotationProcessor.extendsFrom testAnnotationProcessor
    integrationTestImplementation.extendsFrom testImplementation
    integrationTestRuntimeOnly.extendsFrom testRuntimeOnly
}

java {
    toolchain {
        languageVersion.set(JavaLanguageVersion.of("$jdkVersion"))
    }
    withJavadocJar() // Javadoc for "main" source code
    // More configuration needed for "test" or "integrationTest" source code
}

tasks.withType(JavaCompile) {
    options.compilerArgs += ["-Werror", "-Xlint:all,-processing", "-parameters"]
}

test {
    // NB -- JaCoCo draws from _unit tests_, not integration tests
    // When tests fail, you still have a coverage report
    finalizedBy jacocoTestReport
}

tasks.register('integrationTest', Test) {
    description = 'Runs integration tests.'
    group = 'verification'

    testClassesDirs = sourceSets.integrationTest.output.classesDirs
    classpath = sourceSets.integrationTest.runtimeClasspath
    shouldRunAfter test

    testLogging {
        events "passed"
    }
}

check.dependsOn integrationTest

tasks.withType(Test) {
    // Quieter builds when JUL is in use (you or another library or tool)
    // TODO: Keep builds noisy in CI
    systemProperty "java.util.logging.config.file",
            "$projectDir/config/logging.properties"
    // This idiom ensures JUnit5 for integration tests, not just unit tests
    useJUnitPlatform()
}

checkstyle {
    toolVersion = checkstyleVersion
    // default checkstyle config -- specific to your team agreement
    configFile = project(":").file("config/checkstyle/checkstyle.xml")
    // Google style (idiosyncratic to Google):
    // configFile = project(":").file("config/checkstyle/google_checks.xml")
    // SUN style (closest to modern Java styles) -- the basis for this project:
    // configFile = project(":").file("config/checkstyle/sun_checks.xml")
}

tasks.withType(Checkstyle) {
    reports {
        html.required = true
        sarif.required = true
        xml.required = true
    }
}

pmd {
    ignoreFailures = false
    // TODO: targetJdk = 21 -- there is no defined property for this
    toolVersion = pmdVersion

    consoleOutput = true
    rulesMinimumPriority = 5

    // custom-rules.xml contains editable rule set
    // you can use it to adjust rules for your own project
    // See https://docs.gradle.org/current/dsl/org.gradle.api.plugins.quality.PmdExtension.html#org.gradle.api.plugins.quality.PmdExtension:ruleSetFiles
    ruleSetFiles = files(
        "config/pmd/custom-rules.xml"
    )

}

spotbugs {
    effort = Effort.MAX
    reportLevel = Confidence.valueOf("LOW")
    toolVersion = libs.versions.com.github.spotbugs
}

tasks.withType(SpotBugsTask) {
    reports {
        html {
            enabled = true
        }
        sarif {
            enabled = true
        }
        xml {
            enabled = true
        }
    }
}

modernizer {
    failOnViolations = true
    includeTestClasses = true
    javaVersion = "$jdkVersion"
}

jacoco {
    toolVersion = jacocoVersion
}

jacocoTestReport {
    dependsOn test

    reports {
        csv.required = true
        html.required = true
        xml.required = true
    }
}

jacocoTestCoverageVerification {
    violationRules {
        rule {
            limit {
                counter = 'LINE'
                value = 'COVEREDRATIO'
                minimum = coverageLines.toBigDecimal()
            }
        }
        rule {
            limit {
                counter = 'BRANCH'
                value = 'COVEREDRATIO'
                minimum = coverageBranches.toBigDecimal()
            }
        }
        rule {
            limit {
                counter = 'INSTRUCTION'
                value = 'COVEREDRATIO'
                minimum = coverageInstructions.toBigDecimal()
            }
        }
    }
}

pitest {
    junit5PluginVersion = pitestJUnit5PluginVersion
    mutationThreshold = 100
    // Cannot name this "pitestVersion" -- the plugin has a property of the same
    // name, so this property needs to have a distinct name to satisfy Gradle
    pitestVersion = "$pitestToolVersion"
    timestampedReports = false
    verbose = false // Set to true for noisy output
}

tasks.named("pitest") { // PITest plugin does not expose task as expected
    dependsOn jacocoTestCoverageVerification
}

jdepsReport {
    // TODO: Report shows a big mess with dependencies
    // TODO: Why mess with multi-release jars?
    multiReleaseJars = [".*": "$jdkVersion"]
}

dependencyCheck {
    failBuildOnCVSS = 0
    skip = Boolean.getBoolean("owasp.skip") // DEFAULT is false
    suppressionFile = rootProject.file("config/owasp-suppressions.xml")

    nvd {
        // This is intended to come from a local command-line setting, or from
        // an environment variable. CI uses the environment variable.
        // Using a command-line setting is poor practice without strong care
        // so that the key is not leaked.
        apiKey = findProperty("owasp.nvdApiKey") ?: System.getenv("OWASP_NVD_API_KEY")
    }

    // Use this block when mirroring the NIST CVE data -- the data may suffer
    // timeouts for downloading. GitHub, for example, maintains caches of the
    // data, and you might see your local build fail for access, but pass in CI
    // cve {
    //     urlBase = "https://nvd.nist.gov/feeds/json/cve/1.1/nvdcve-1.1-%d.json.gz"
    //     // urlBase = "file:///PATH/TO/mirror/nvdcve-1.1-%d.json.gz"
    //     urlModified = "https://nvd.nist.gov/feeds/json/cve/1.1/nvdcve-1.1-modified.json.gz"
    //     // urlModified = "file:///PATH/TO/mirror/nvdcve-1.1-modified.json.gz"
    // }
}

jar {
    manifest {
        attributes 'Main-Class': "$mainClass"
        attributes 'Add-Opens': 'java.base/java.lang java.base/java.util java.base/java.lang.reflect'
    }
}

check {
    dependsOn += jacocoTestCoverageVerification
    dependsOn += "pitest"
    dependsOn += integrationTest
    dependsOn += dependencyCheckAnalyze
}

/*
tasks.withType(DependencyUpdatesTask) {
    rejectVersionIf {
        !isStable(it.candidate.version) && isStable(it.currentVersion)
    }
}
*/

wrapper {
    gradleVersion = gradleWrapperVersion
    distributionType = "ALL"
}

// TODO: Decide if we should only check dependencies that are released
/*
static def isStable(version) {
    def stableKeyword = ["RELEASE", "FINAL", "GA"].any {
        version.uppercase().contains(it)
    }
    def otherReleasePattern = version ==~ '^[0-9,.v-]+(-r)?$'

    return stableKeyword || otherReleasePattern
}
*/

spotless {
    // enforceCheck false
    // NOTE: If you'd like to hold off these checks, you can uncomment this
    // line. The default is "true".
    // The example project passes cleanly when enforcing checks.
}