build.gradle

import com.adarshr.gradle.testlogger.theme.ThemeType
import com.github.benmanes.gradle.versions.updates.DependencyUpdatesTask
import com.github.spotbugs.snom.SpotBugsTask

plugins {
    id "build-dashboard" // See build/reports/buildDashboard/index.html
    // TODO: project-report is presently broken because of pitest task
    id "project-report" // Try the `projectReport` task
    id "java" // Gradle support for Java
    id "checkstyle" // To check that code follow style standards
    id "pmd" // Static analysis based on source (does not check compiled code)
    id "jacoco" // To run test coverage
    id "application" // To build the executable jar

    alias libs.plugins.dependency.check  // To push security to the left
    alias libs.plugins.jdeps
    alias libs.plugins.modernizer
    alias libs.plugins.pitest  // To run mutation testing
    alias libs.plugins.sbom  // Embeds SPDX Software Bill Of Materials (SBOMs) files in JARs
    alias libs.plugins.sigstore  // Signing via Sigstore for library releases (sigstore.dev)
    alias libs.plugins.spotbugs  // Static analysis based on compiled code (does not check source)
    alias libs.plugins.tasktree
    alias libs.plugins.testlogger
    alias libs.plugins.versions  // Try the `dependencyUpdates` task
}

version = "0-SNAPSHOT"
group = "demo"

dependencies {
    sigstoreClient libs.sigstore

    implementation libs.jakarta.annotation
    compileOnly libs.lombok
    annotationProcessor libs.lombok
    compileOnly libs.spotbugs
    compileOnly libs.findbugs
    compileOnly libs.modernizer

    testCompileOnly libs.lombok
    testAnnotationProcessor libs.lombok
    testCompileOnly libs.findbugs

    testImplementation libs.junit.jupiter
    testImplementation libs.assertj
    testImplementation libs.mockito
    testImplementation libs.systemlambda

    // Quiet build -- build works without this, but JUnit complains
    testRuntimeOnly libs.junit.jupiter.engine

    spotbugsPlugins libs.findsecbugs

    // Give special attention to https://blog.gradle.org/log4j-vulnerability
    // Gradle 7.3.3+ addresses this out of the box. If you are using Gradle
    // <7.3.3 (this project is current), you *must* add this:
    /*
    constraints {
        implementation("org.apache.logging.log4j:log4j-core") {
            version {
                strictly("[2.17, 3[")
                prefer("2.17.1")
            }
            because("CVE-2021-44228, CVE-2021-45046, CVE-2021-45105: Log4j vulnerable to remote code execution and other critical security vulnerabilities")
        }
    }
    */
    // Give special attention to a BCEL CVE triggered by Spotbugs
    // TODO: Update spotbugs for CVE-2022-42920
    constraints {
        spotbugs("org.apache.bcel:bcel") {
            version {
                strictly("[6.7.0, 7[")
            }
            because("CVE-2022-42920: BCEL out-of-bounds but can create arbitrary bytecode")
        }
    }
}

sourceSets {
    integrationTest {
        compileClasspath += sourceSets.main.output
        compileClasspath += sourceSets.test.output
        runtimeClasspath += sourceSets.main.output
        runtimeClasspath += sourceSets.test.output
    }
}

sigstoreSign {
    oidcClient {
        gitHub {
            audience.set("sigstore")
        }
        web {
            clientId.set("sigstore")
            issuer.set("https://oauth2.sigstore.dev/auth")
        }
    }
}

configurations {
    integrationTestImplementation.extendsFrom testImplementation
    integrationTestRuntimeOnly.extendsFrom testRuntimeOnly
}

// TODO: Work around GitHub issue #54
configurations.pmd {
    resolutionStrategy {
        forcedModules = ["commons-io:commons-io:2.11.0"]
    }
}

java {
    modularity.inferModulePath = true

    toolchain {
        languageVersion = JavaLanguageVersion.of("$jdkVersion")
        vendor = JvmVendorSpec.ADOPTIUM
    }
}

tasks.withType(JavaCompile).configureEach {
    options.compilerArgs += ["-Werror", "-Xlint:all,-processing", "-parameters", "-Xlint:-requires-automatic", "-Xlint:-requires-transitive-automatic"]
}

test {
    // NB -- JaCoCo draws from _unit tests_, not integration tests
    // When tests fail, you still have a coverage report
    finalizedBy jacocoTestReport

    // Important: Remove this when you actually use this codebase. Tests cannot be cached for local
    // testing of the sample. In most projects, this directive below should be deleted.
    outputs.upToDateWhen { false }
}

testlogger {
    theme = ThemeType.MOCHA
    showFailed = true
    showPassed = true
    showSkipped = true
}

spdxSbom {
    targets {
        create("release") {
            scm {
                uri.set("https://github.com/binkley/modern-java-practices.git")
                tool.set("git")
            }
        }
    }
}

tasks.register('integrationTest', Test) {
    description = 'Runs integration tests.'
    group = 'verification'

    testClassesDirs = sourceSets.integrationTest.output.classesDirs
    classpath = sourceSets.integrationTest.runtimeClasspath
    shouldRunAfter test

    // Important: Remove this when you actually use this codebase. Tests cannot be cached for local
    // testing of the sample. In most projects, this directive below should be deleted.
    outputs.upToDateWhen { false }
}

check.dependsOn integrationTest

tasks.withType(Test).configureEach {
    // Quieter builds when JUL is in use (you or another library or tool)
    // TODO: Keep builds noisy in CI
    systemProperty "java.util.logging.config.file",
            "$projectDir/config/logging.properties"
    // This idiom ensures JUnit5 for integration tests, not just unit tests
    useJUnitPlatform()
}

checkstyle {
    toolVersion = libs.versions.checkstyle.get()
    // default checkstyle config -- specific to your team agreement
    configFile = project(":").file("config/checkstyle/checkstyle.xml")
    // Google style (idiosyncratic to Google):
    // configFile = project(":").file("config/checkstyle/google_checks.xml")
    // SUN style (closest to modern Java styles) -- the basis for this project:
    // configFile = project(":").file("config/checkstyle/sun_checks.xml")
}

pmd {
    ignoreFailures = false
    // TODO: targetJdk = 21 -- there is no defined property for this
    toolVersion = libs.versions.pmd.get()

    consoleOutput = true
    rulesMinimumPriority = 5


    // custom-rules.xml contains editable rule set
    // you can use it to adjust rules for your own project
    ruleSets = [
            rootProject.file("config/pmd/custom-rules.xml")
    ]
}

// @TODO(sgammon): Broken?
tasks.pmdMain {
    enabled = false
}
tasks.pmdTest {
    enabled = false
}
tasks.pmdIntegrationTest {
    enabled = false
}

spotbugs {
    effort = "Max"
    reportLevel = "Low"
    toolVersion = libs.versions.spotbugs.core.get()
}

tasks.withType(SpotBugsTask).configureEach {
    reports {
        html {
            enabled = true
        }
        xml {
            enabled = true
        }
    }
}

modernizer {
    failOnViolations = true
    includeTestClasses = true
    javaVersion = "$jdkVersion"
}

jacoco {
    toolVersion = libs.versions.jacoco.get()
}

jacocoTestReport {
    dependsOn test

    reports {
        xml.required = System.getenv("CI") == "true"
    }
}

jacocoTestCoverageVerification {
    violationRules {
        rule {
            limit {
                minimum = 1.00
            }
        }
    }
}

pitest {
    junit5PluginVersion = libs.versions.pitest.junit5.get()
    mutationThreshold = 100
    // Cannot name this "pitestVersion" -- the plugin has a property of the same
    // name, so this property needs to have a distinct name to satisfy Gradle
    pitestVersion = libs.versions.pitest.tool.get()
    timestampedReports = false
    verbose = true
}

tasks.named("pitest") { // PITest plugin does not expose task as expected
    dependsOn jacocoTestCoverageVerification
}

jdepsReport {
    // TODO: Report shows a big mess with dependencies
    // TODO: Why mess with multi-release jars?
    multiReleaseJars = [".*": "$jdkVersion"]

    modular = true
    moduleOptions {
        addModules = ['jakarta.annotation']
    }
}

dependencyCheck {
    failBuildOnCVSS = 0
    skip = Boolean.getBoolean("owasp.skip") // DEFAULT is false
    suppressionFile = rootProject.file("config/owasp-suppressions.xml")

    // Use this block when mirroring the NIST CVE data -- the data may suffer
    // timeouts for downloading. GitHub, for example, maintains caches of the
    // data, and you might see your local build fail for access, but pass in CI
    // cve {
    //     urlBase = "https://nvd.nist.gov/feeds/json/cve/1.1/nvdcve-1.1-%d.json.gz"
    //     // urlBase = "file:///PATH/TO/mirror/nvdcve-1.1-%d.json.gz"
    //     urlModified = "https://nvd.nist.gov/feeds/json/cve/1.1/nvdcve-1.1-modified.json.gz"
    //     // urlModified = "file:///PATH/TO/mirror/nvdcve-1.1-modified.json.gz"
    // }
}

jar {
    manifest {
        attributes 'Main-Class': "$mainClass"
        attributes 'Add-Opens': 'java.base/java.lang java.base/java.util java.base/java.lang.reflect'
    }
}

dependencyLocking {
    lockAllConfigurations()
    lockMode = LockMode.LENIENT
}

tasks.dependencyCheckAnalyze {
    enabled = false  // disabled because NVD is down :(
}

check {
    dependsOn += jacocoTestCoverageVerification
    dependsOn += "pitest"
    dependsOn += integrationTest
    dependsOn += dependencyCheckAnalyze
}

tasks.withType(DependencyUpdatesTask).configureEach {
    rejectVersionIf {
        !isStable(it.candidate.version) && isStable(it.currentVersion)
    }
}

wrapper {
    gradleVersion = gradleWrapperVersion
    distributionType = "ALL"
}

static def isStable(version) {
    def stableKeyword = ["RELEASE", "FINAL", "GA"].any {
        version.uppercase().contains(it)
    }
    def otherReleasePattern = version ==~ '^[0-9,.v-]+(-r)?$'

    return stableKeyword || otherReleasePattern
}