build.gradle

import org.gradle.api.tasks.Exec

plugins {
  id 'application'
  id 'checkstyle'
  id 'jacoco'
  id 'io.spring.dependency-management' version '1.1.0'
  id 'org.springframework.boot' version '3.1.6'
  id 'org.owasp.dependencycheck' version '9.0.10'
  id 'com.github.ben-manes.versions' version '0.45.0'
  id 'org.sonarqube' version '3.4.0.2513'
  id 'au.com.dius.pact' version '4.3.15'
  id "io.freefair.lombok" version "6.6.1"
}

def versions = [
  junit             : '5.7.0',
  junitPlatform     : '1.9.2',
  springBoot        : springBoot.class.package.implementationVersion,
  springStatemachine: '3.2.0',
  springfoxSwagger  : '3.0.0',
  lombok            : '1.18.28',
  springSecurity    : '6.0.8',
  pact              : '3.5.24',
  camunda           : '7.20.0'
]

group = 'uk.gov.hmcts.reform'
version = '0.0.1'

allprojects {
  java {
    toolchain {
      languageVersion = JavaLanguageVersion.of(17)
    }
  }

  apply plugin: 'java'
  apply plugin: 'jacoco'
  apply plugin: 'checkstyle'
  apply plugin: 'io.spring.dependency-management'
  apply plugin: 'org.springframework.boot'
  apply plugin: 'org.owasp.dependencycheck'
  apply plugin: 'com.github.ben-manes.versions'

  checkstyle {
    maxWarnings = 0
    toolVersion = '10.4'
    getConfigDirectory().set(new File(rootDir, 'config/checkstyle'))
  }

  jacoco {
    toolVersion = '0.8.8' // jacocoMavenPluginVersion
    reportsDirectory = file("$buildDir/reports/jacoco")
  }

// before committing a change, make sure task still works
  dependencyUpdates {
    def isNonStable = { String version ->
      def stableKeyword = ['RELEASE', 'FINAL', 'GA'].any { qualifier -> version.toUpperCase().contains(qualifier) }
      def regex = /^[0-9,.v-]+$/
      return !stableKeyword && !(version ==~ regex)
    }
    rejectVersionIf { selection -> // <---- notice how the closure argument is named
      return isNonStable(selection.candidate.version) && !isNonStable(selection.currentVersion)
    }
  }

// https://jeremylong.github.io/DependencyCheck/dependency-check-gradle/configuration.html
  dependencyCheck {
    // Specifies if the build should be failed if a CVSS score above a specified level is identified.
    // range of 0-10 fails the build, anything greater and it doesn't fail the build
    failBuildOnCVSS = System.getProperty('dependencyCheck.failBuild') == 'true' ? 0 : 11
    suppressionFile = 'config/owasp/suppressions.xml'

    analyzers {
      // Disable scanning of .NET related binaries
      assemblyEnabled = false
      retirejs {
        enabled = false
      }
      ossIndex {
        enabled = false
      }
    }
  }

  dependencyManagement {
    dependencies {
      // CVE-2020-26945 - Mishandles deserialization of object streams.
      dependency group: 'org.mybatis', name: 'mybatis', version: '3.5.11'
      // CVE-2018-10237 - Unbounded memory allocation
      dependencySet(group: 'com.google.guava', version: '33.1.0-jre') {
        entry 'guava'
      }

      // Solves CVE-2023-35116
      dependency group: 'com.fasterxml.jackson.core', name: 'jackson-databind', version: '2.17.0'
      dependency group: 'com.fasterxml.jackson.core', name: 'jackson-core', version: '2.17.0'
      dependency group: 'com.fasterxml.jackson.core', name: 'jackson-annotations', version: '2.17.0'

      // Solves CVE-2023-3635
      dependency group: 'com.squareup.okio', name: 'okio', version: '3.4.0'

      dependency group: 'org.jetbrains.kotlin', name: 'kotlin-stdlib-common', version: '1.8.10'
      dependency group: 'org.jetbrains.kotlin', name: 'kotlin-stdlib-jdk7', version: '1.8.10'
      dependency group: 'org.jetbrains.kotlin', name: 'kotlin-stdlib-jdk8', version: '1.8.10'
      dependency group: 'org.jetbrains.kotlin', name: 'kotlin-stdlib', version: '1.8.0'
      dependency group: 'org.jetbrains.kotlin', name: 'kotlin-reflect', version: '1.8.10'

      //Solves CVE-2023-5072
      dependency group: 'org.json', name: 'json', version: '20231013'

      //Solves CVE-2022-1471
      dependency group: 'org.yaml', name: 'snakeyaml', version: '2.2'

      //Solves CVE-2023-34034, CVE-2023-34035
      dependency group: 'org.springframework.security', name: 'spring-security-crypto', version: '6.2.1'

      // To prevent other libraries using conflicting versions
      dependency group: 'org.slf4j', name: 'slf4j-nop', version: '2.0.5'

      dependency group: 'commons-fileupload', name: 'commons-fileupload', version: '1.5'

      // Solves CVE-2022-31159, happens only on local builds when running dependencyCheck gradle task
      dependencySet(
        group: 'com.amazonaws',
        version: '1.12.689'
      ) {
        entry 'aws-java-sdk-core'
        entry 'aws-java-sdk-kms'
        entry 'aws-java-sdk-s3'
      }
      // Solves CVE-2020-17521
      dependencySet(
        group: 'org.codehaus.groovy',
        version: '2.4.21'
      ) {
        entry 'groovy-all'
      }

      // CVE-2023-6378
      dependencySet(group: 'ch.qos.logback', version: '1.4.12') {
        entry 'logback-core'
        entry 'logback-classic'
      }
    }
    imports {
      mavenBom 'org.springframework.cloud:spring-cloud-dependencies:2021.0.8'
    }
  }

  configurations {
    testCompile.exclude group: 'ch.qos.logback', module: 'logback-classic'
  }

  repositories {
    mavenLocal()
    mavenCentral()
    maven {
      url "https://jitpack.io"
    }
  }
}

sourceSets {
  integrationTest {
    java {
      compileClasspath += main.output
      runtimeClasspath += main.output
      srcDir file('src/integrationTest/java')
    }
    resources.srcDir file('src/integrationTest/resources')
  }

  contractTest {
    java {
      compileClasspath += main.output
      runtimeClasspath += main.output
      srcDir file('src/contractTest/java')
    }
    resources.srcDir file('src/contractTest/resources')
  }
}

tasks.withType(JavaCompile) {
  options.compilerArgs << "-Xlint:unchecked" << "-Werror"
}

tasks.withType(Test) {
  useJUnitPlatform()

  testLogging {
    exceptionFormat = 'full'
  }
}

test {
  failFast = true
}

task integration(type: Test) {
  description = "Runs integration tests"
  group = "Verification"
  testClassesDirs = sourceSets.integrationTest.output.classesDirs
  classpath = sourceSets.integrationTest.runtimeClasspath
  failFast = true
  testLogging.showStandardStreams = false
}

task contract(type: Test) {
  group = 'Delivery pipeline'
  description = 'Runs the consumer Pact tests'
  setTestClassesDirs(sourceSets.contractTest.output.classesDirs)
  setClasspath(sourceSets.contractTest.runtimeClasspath)
  systemProperty 'pact.rootDir', "pacts"
}

task fortifyScan(type: JavaExec, description: 'Run fortify scan.') {
  getMainClass().set("uk.gov.hmcts.fortifyclient.FortifyClientMainApp")
  classpath += sourceSets.test.runtimeClasspath
  jvmArgs = ['--add-opens=java.base/java.lang.reflect=ALL-UNNAMED']
}

tasks.withType(Copy) {
  duplicatesStrategy = DuplicatesStrategy.EXCLUDE
}

task awaitApplicationReadiness(type: Exec, description: 'Awaits until application is ready.') {
  commandLine './bin/wait-for.sh'
}

task runSmokeTests(type: Exec, description: 'Runs smoke tests.') {
  commandLine '/usr/bin/yarn', '--silent', 'run', 'test:ga-smoke'
}

task runCrossBrowserTests(type: Exec, description: 'Runs cross browser tests.') {
  commandLine '/usr/bin/yarn', '--silent', 'run', 'test:crossbrowser'
}

def inStrictOrder(Task... tasks) {
  for (int i = 0; i < tasks.size() - 1; i++) {
    tasks[i + 1].mustRunAfter(tasks[i])
  }
  return tasks
}

task runApiTests(type: Exec, description: 'Runs Api tests.') {
  onlyIf {
    return (System.env.ENVIRONMENT == 'preview' || System.env.ENVIRONMENT == 'aat')
  }
  commandLine '/usr/bin/yarn', '--silent', 'run', 'test:api'
}

task runNonProdApiTests(type: Exec, description: 'Runs non prod features in functional tests.') {
  onlyIf {
    return System.env.ENVIRONMENT == 'preview'
  }
  commandLine '/usr/bin/yarn', '--silent', 'run', 'test:api-nonprod'
}

task runNightlyAPITests(type: Exec, description: 'Runs Full API tests.') {
  onlyIf {
    return System.env.NIGHTLY_BUILD == 'true'
  }
  commandLine '/usr/bin/yarn', '--silent', 'run', 'test:nightly-api-tests'
}

task smoke(description: 'Runs the smoke tests.') {
  dependsOn(inStrictOrder(awaitApplicationReadiness, runSmokeTests))
}

task functional(description: 'Runs the functional tests.') {
  dependsOn(inStrictOrder(awaitApplicationReadiness, runApiTests,runNonProdApiTests,runNightlyAPITests))
}

task crossbrowser(description: 'Runs the crossbrowser tests.') {
  dependsOn(inStrictOrder(awaitApplicationReadiness, runCrossBrowserTests))
}

project.tasks['sonarqube'].dependsOn test, integration, jacocoTestReport

sonarqube {
  properties {
    property "sonar.projectName", "Reform :: civil-general-applications"
    property "sonar.projectKey", "civil-general-applications"
    property "sonar.coverage.jacoco.xmlReportPaths", "${jacocoTestReport.reports.xml.destination.path}"
    property "sonar.coverage.exclusions", "**/model/**, **/config/**/*Configuration.java,**/testingsupport/**, **/*ExternalTaskListener.java, **/stereotypes/**, **/*Exception.java"
    property "sonar.cpd.exclusions", "**/*DocumentManagementService.java"
    property "sonar.host.url", "https://sonar.reform.hmcts.net/"
  }
}

jacocoTestReport {
  executionData(test, integration)
  executionData fileTree(project.rootDir.absolutePath).include("**/build/jacoco/*.exec")
  subprojects.each {
    sourceSets it.sourceSets.main
  }
  reports {
    xml.enabled = true
    csv.enabled = false
    xml.destination file("${buildDir}/reports/jacoco/test/jacocoTestReport.xml")
  }
}

jacocoTestReport.dependsOn {
  subprojects*.test
}



ext.libraries = [
  junit5: [
    "org.junit.jupiter:junit-jupiter-api:${versions.junit}",
    "org.junit.jupiter:junit-jupiter-engine:${versions.junit}",
    "org.junit.jupiter:junit-jupiter-params:${versions.junit}",
    "org.junit.platform:junit-platform-commons:${versions.junitPlatform}",
    "org.junit.platform:junit-platform-engine:${versions.junitPlatform}"
  ]
]

configurations.all {
  resolutionStrategy.eachDependency { details ->
    if (details.requested.group == 'org.projectlombok') {
      details.useVersion versions.lombok
    }
  }
  exclude group: 'org.springframework.security', module: 'spring-security-rsa'
}

dependencies {
  implementation group: 'org.springframework.boot', name: 'spring-boot-starter-web'
  implementation group: 'org.springframework.boot', name: 'spring-boot-starter-actuator'
  implementation group: 'org.springframework.boot', name: 'spring-boot-starter-aop'
  implementation group: 'org.springframework', name: 'spring-aspects'
  implementation group: 'org.springframework.boot', name: 'spring-boot-starter-json'
  implementation group: 'org.springframework.boot', name: 'spring-boot-starter-validation'
  implementation 'org.apache.httpcomponents.client5:httpclient5:5.2.1'

  implementation group: 'org.springframework.statemachine', name: 'spring-statemachine-core', version: versions.springStatemachine
  implementation group: 'org.springframework.statemachine', name: 'spring-statemachine-test', version: versions.springStatemachine

  implementation group: 'org.springdoc', name: 'springdoc-openapi-starter-webmvc-ui', version: '2.0.4'

  implementation group: 'org.jdbi', name: 'jdbi3-sqlobject', version: '3.37.1'
  implementation group: 'org.jdbi', name: 'jdbi3-spring4', version: '3.19.0'

  implementation group: 'org.apache.logging.log4j', name: 'log4j-api', version: '2.20.0'
  implementation group: 'org.apache.logging.log4j', name: 'log4j-to-slf4j', version: '2.20.0'

  implementation group: 'com.github.hmcts.java-logging', name: 'logging', version: '6.0.1'
  implementation group: 'org.springframework.cloud', name: 'spring-cloud-starter-netflix-hystrix', version: '2.2.10.RELEASE'
  implementation group: 'org.springframework.cloud', name: 'spring-cloud-context', version: '4.0.4'
  implementation group: 'org.springframework.cloud', name: 'spring-cloud-starter-openfeign', version: '4.0.4'
  implementation group: 'org.springframework.cloud', name: 'spring-cloud-openfeign-core', version: '4.0.4'
  implementation group: 'io.github.openfeign', name: 'feign-httpclient', version: '12.1'
  implementation group: 'org.springframework.retry', name: 'spring-retry'
  // hmcts libraries
  implementation group: 'com.github.hmcts', name: 'service-auth-provider-java-client', version: '5.1.0'
  implementation group: 'com.github.hmcts', name: 'core-case-data-store-client', version: '4.9.2'
  implementation group: 'com.github.hmcts', name: 'document-management-client', version: '7.0.0'
  implementation('com.github.hmcts:fees-java-client:0.0.6') {
    exclude group: 'uk.gov.hmcts.reform', module: 'java-logging'
  }
  implementation('com.github.hmcts:payments-java-client:1.6.7') {
    exclude group: 'uk.gov.hmcts.reform', module: 'java-logging'
    exclude group: 'uk.gov.hmcts.reform', module: 'service-auth-provider-client'
  }
  implementation group: 'uk.gov.service.notify', name: 'notifications-java-client', version: '4.1.0-RELEASE'
  implementation group: 'com.github.hmcts', name: 'ccd-case-document-am-client', version: '1.7.1'

  annotationProcessor group: 'org.projectlombok', name: 'lombok', version: versions.lombok
  compileOnly group: 'org.projectlombok', name: 'lombok', version: versions.lombok

  implementation group: 'org.springframework.boot', name: 'spring-boot-starter-cache'
  implementation group: 'com.github.ben-manes.caffeine', name: 'caffeine', version: '3.1.3'

  implementation group: 'org.springframework.security', name: 'spring-security-web', version: versions.springSecurity
  implementation group: 'org.springframework.security', name: 'spring-security-config', version: versions.springSecurity
  implementation group: 'org.springframework.security', name: 'spring-security-core', version: versions.springSecurity
  implementation group: 'org.springframework.security', name: 'spring-security-oauth2-resource-server', version: versions.springSecurity
  implementation group: 'org.springframework.security', name: 'spring-security-oauth2-client', version: versions.springSecurity
  implementation group: 'org.springframework.security', name: 'spring-security-oauth2-jose', version: versions.springSecurity
  implementation group: 'org.springframework.security', name: 'spring-security-oauth2-core', version: versions.springSecurity
  implementation group: 'com.nimbusds', name: 'nimbus-jose-jwt', version: '9.30.1'
  implementation group: 'io.jsonwebtoken', name: 'jjwt', version: '0.9.1'
  implementation group: 'com.github.hmcts', name: 'idam-java-client', version: '3.0.3'

  implementation group: 'org.elasticsearch', name: 'elasticsearch', version: '7.15.2'

  implementation group: 'com.networknt', name: 'json-schema-validator', version: '1.0.75'

  implementation group: 'org.camunda.bpm', name: 'camunda-external-task-client', version: versions.camunda
  implementation group: 'org.camunda.community.rest', name: 'camunda-platform-7-rest-client-spring-boot-starter', version: versions.camunda
  implementation group: 'org.camunda.bpm', name: 'camunda-engine-rest-core', version: versions.camunda

  implementation group: 'com.fasterxml.jackson.module', name: 'jackson-module-kotlin', version: '2.14.2'
  implementation group: 'com.fasterxml.jackson.datatype', name: 'jackson-datatype-jsr310', version: '2.15.2'

  // JAX-B dependencies for JDK 9+
  implementation group: 'javax.xml.bind', name: 'jaxb-api', version: '2.3.1'
  implementation group: 'jakarta.xml.bind', name: 'jakarta.xml.bind-api', version: '4.0.0'
  implementation group: 'org.glassfish.jaxb', name: 'jaxb-runtime', version: '4.0.2'

  implementation group: 'com.launchdarkly', name: 'launchdarkly-java-server-sdk', version: '6.3.0'


  testImplementation group: 'org.mockito', name: 'mockito-junit-jupiter', version: '5.1.1'
  testImplementation group: 'org.mockito', name: 'mockito-core', version: '5.1.1'
  testImplementation group: 'org.mockito', name: 'mockito-junit-jupiter', version: '5.1.1'
  testImplementation group: 'org.mockito', name: 'mockito-inline', version: '5.1.1'

  testAnnotationProcessor group: 'org.projectlombok', name: 'lombok', version: versions.lombok
  testCompileOnly group: 'org.projectlombok', name: 'lombok', version: versions.lombok

  testImplementation libraries.junit5
  testImplementation group: 'org.springframework.boot', name: 'spring-boot-starter-test'

  testImplementation group: 'io.rest-assured', name: 'rest-assured'

  testImplementation group: 'org.springframework.statemachine', name: 'spring-statemachine-test', version: versions.springStatemachine
  testImplementation 'com.github.hmcts:fortify-client:1.3.0:all'
  //pact contract testing
  contractTestImplementation 'au.com.dius.pact.consumer:junit5:4.6.5'
  contractTestImplementation group: 'org.hamcrest', name: 'java-hamcrest', version: '2.0.0.0'
  contractTestImplementation('org.junit.jupiter:junit-jupiter-api:5.10.2')
  contractTestImplementation('org.junit.jupiter:junit-jupiter-engine:5.10.2')
  contractTestImplementation sourceSets.main.runtimeClasspath
  contractTestImplementation sourceSets.test.runtimeClasspath

  testImplementation(platform('org.junit:junit-bom:5.9.2'))
  testImplementation group: 'org.springframework.boot', name: 'spring-boot-starter-test', {
    exclude group: 'junit', module: 'junit'
    exclude group: 'org.junit.vintage', module: 'junit-vintage-engine'
  }

  integrationTestImplementation sourceSets.main.runtimeClasspath
  integrationTestImplementation sourceSets.test.runtimeClasspath
}

mainClassName = 'uk.gov.hmcts.reform.civil.Application'

bootJar {
  archiveFileName = "civil-general-applications.jar"

  manifest {
    attributes('Implementation-Version': project.version.toString())
  }
}

// Gradle 7.x issue, workaround from: https://github.com/gradle/gradle/issues/17236#issuecomment-894768083
//rootProject.tasks.named("processSmokeTestResources") {
// duplicatesStrategy = 'include'
//}

wrapper {
  distributionType = Wrapper.DistributionType.ALL
}

task runAndPublishConsumerPactTests(type: Test) {
  dependsOn(contract)
  logger.lifecycle("Runs pact Tests")
  testClassesDirs = sourceSets.contractTest.output.classesDirs
  classpath = sourceSets.contractTest.runtimeClasspath
  finalizedBy(pactPublish)
}

project.ext {
  pactVersion = getCheckedOutGitCommitHash()
}

pact {
  publish {
    pactDirectory = 'pacts'
    pactBrokerUrl = System.getenv("PACT_BROKER_FULL_URL") ?: 'http://localhost:80'
    tags = [System.getenv("PACT_BRANCH_NAME") ?: 'Dev']
    version = project.pactVersion
  }
}

def getCheckedOutGitCommitHash() {
  'git rev-parse --verify --short HEAD'.execute().text.trim()
}