build.gradle

plugins {
  id 'application'
  id 'checkstyle'
  id 'pmd'
  id 'jacoco'
  id 'io.spring.dependency-management' version '1.0.6.RELEASE'
  id 'org.flywaydb.flyway' version '5.2.1'
  id 'org.springframework.boot' version '1.5.22.RELEASE' // remove tomcat version override on spring boot bump
  id 'org.owasp.dependencycheck' version '5.1.0'
  id 'com.github.ben-manes.versions' version '0.20.0'
  id 'org.sonarqube' version '2.6.2'
}

group = 'uk.gov.hmcts.reform'
version = '0.0.1'

// it is important to specify logback classic and core packages explicitly as libraries like spring boot
// enforces it's own (older) version which is not recommended.
def versions = [
  ff4j            : '1.7.3',
  logback         : '1.2.3',
  reformLogging   : '5.1.1',
  springBoot      : springBoot.class.package.implementationVersion,
  springHystrix   : '1.4.6.RELEASE',
  springfoxSwagger: '2.9.2'
]

sourceCompatibility = 1.8
targetCompatibility = 1.8

configurations.all {
  exclude group: "org.webjars", module: "d3js"
}

sourceSets {
  functionalTest {
    java {
      compileClasspath += main.output
      runtimeClasspath += main.output
      srcDir file('src/functionalTest/java')
    }
    resources.srcDirs += file('src/functionalTest/resources')
  }

  integrationTest {
    java {
      compileClasspath += main.output
      runtimeClasspath += main.output
      srcDir file('src/integrationTest/java')
    }
    resources.srcDirs += file('src/integrationTest/resources')
  }
}

tasks.withType(JavaCompile) {
  options.compilerArgs << "-Xlint:unchecked" << "-Werror"
}

task functional(type: Test, description: 'Runs functional tests', group: 'Verification') {
  testClassesDirs = sourceSets.functionalTest.output.classesDirs
  classpath = sourceSets.functionalTest.runtimeClasspath
}

task integration(type: Test, description: 'Runs integration tests', group: 'Verification') {
  testClassesDirs = sourceSets.integrationTest.output.classesDirs
  classpath = sourceSets.integrationTest.runtimeClasspath

  environment("APPINSIGHTS_INSTRUMENTATIONKEY", "integration-test-key")
}

task smoke(type: Test, description: 'Runs smoke tests') {
  testClassesDirs = sourceSets.functionalTest.output.classesDirs
  classpath = sourceSets.functionalTest.runtimeClasspath

  useJUnit {
    includeCategories 'uk.gov.hmcts.reform.feature.categories.SmokeTestCategory'
  }
}

checkstyle {
  maxWarnings = 0
  toolVersion = '8.29'
  sourceSets = [sourceSets.main, sourceSets.test, sourceSets.functionalTest, sourceSets.integrationTest]
  // need to set configDir to rootDir otherwise submodule will use submodule/config/checkstyle
  configDir = new File(rootDir, 'config/checkstyle')
}

pmd {
  toolVersion = "6.3.0"
  ignoreFailures = true
  reportsDir = file("$project.buildDir/reports/pmd")
  ruleSetFiles = files("$rootDir/config/pmd/ruleset.xml")
}

jacocoTestReport {
  executionData(test, integration)

  reports {
    xml.enabled = true
    csv.enabled = false
    xml.destination = file("${project.buildDir}/reports/jacoco/test/jacocoTestReport.xml")
  }
}

project.tasks['sonarqube'].dependsOn test, integration

sonarqube {
  properties {
    property "sonar.projectName", "Reform :: Feature Toggle API"
    property "sonar.jacoco.reportPath", "${project.buildDir}/jacoco/test.exec"
    property "sonar.jacoco.itReportPath", "${project.buildDir}/jacoco/integration.exec"
  }
}

repositories {
  jcenter()
  // until new projects get to jcenter
  maven {
    url "https://dl.bintray.com/hmcts/hmcts-maven"
  }
}

dependencyUpdates.resolutionStrategy = {
  componentSelection { rules ->
    rules.all { ComponentSelection selection ->
      boolean rejected = ['alpha', 'beta', 'rc', 'cr', 'm'].any { qualifier ->
        selection.candidate.version ==~ /(?i).*[.-]${qualifier}[.\d-]*/
      }
      if (rejected) {
        selection.reject('Release candidate')
      }
    }
  }
}

// https://jeremylong.github.io/DependencyCheck/dependency-check-gradle/configuration.html
dependencyCheck {
  // Specifies if the build should be failed if a CVSS score above a specified level is identified.
  // range of 0-10 fails the build, anything greater and it doesn't fail the build
  failBuildOnCVSS = System.getProperty('dependencyCheck.failBuild') == 'true' ? 0 : 11
  suppressionFile = 'config/owasp/suppressions.xml'
  analyzers {
      // Disable scanning of .NET related binaries
      assemblyEnabled = false
    }
}

dependencyManagement {
  dependencies {
    // does not properly cache method references when used with OGNL before 3.0.12,
    // which allows remote attackers to cause a denial of service (block access to a web site) via unspecified vectors.
    dependencySet(group: 'ognl', version: '3.0.12') {
      entry 'ognl'
    }
    // before 1.3.2: allows remote attackers to cause a denial of service (CPU consumption) via a long boundary string
    // before 1.3.3: DiskFileItem File Manipulation Remote Code Execution
    dependencySet(group: 'commons-fileupload', version: '1.3.3') {
      entry 'commons-fileupload'
    }

    // CVE-2019-0232 - command line injections on windows - fixed on spring boot master but not released
    dependencySet(group: 'org.apache.tomcat.embed', version: '8.5.51') {
      entry 'tomcat-embed-core'
      entry 'tomcat-embed-el'
      entry 'tomcat-embed-websocket'
    }
    dependency group: 'commons-beanutils', name: 'commons-beanutils', version: '1.9.4'
  }
}

configurations.all {
  resolutionStrategy {
    eachDependency { DependencyResolveDetails details ->
      if (details.requested.group in ['com.fasterxml.jackson.core', 'com.fasterxml.jackson.module', 'com.fasterxml.jackson.datatype']) {
        details.useVersion '2.10.0'
      }
    }
  }
}

dependencies {
  compile group: 'org.springframework.boot', name: 'spring-boot-starter-web', version: versions.springBoot
  compile group: 'org.springframework.boot', name: 'spring-boot-starter-actuator', version: versions.springBoot
  compile group: 'org.springframework.boot', name: 'spring-boot-starter-aop', version: versions.springBoot
  compile group: 'org.springframework.boot', name: 'spring-boot-starter-jdbc', version: versions.springBoot
  compile group: 'org.springframework.session', name: 'spring-session-jdbc', version: '1.3.3.RELEASE'

  compile group: 'io.springfox', name: 'springfox-swagger2', version: versions.springfoxSwagger
  compile group: 'io.springfox', name: 'springfox-swagger-ui', version: versions.springfoxSwagger

  compile group: 'com.google.guava', name: 'guava', version: '28.0-jre'

  compile group: 'uk.gov.hmcts.reform', name: 'logging', version: versions.reformLogging
  compile group: 'uk.gov.hmcts.reform', name: 'logging-appinsights', version: versions.reformLogging
  compile ("uk.gov.hmcts.reform:properties-volume-spring-boot-starter:0.0.4"){
   exclude group: 'org.springframework.cloud' , module : 'spring-cloud-context'
   exclude group: 'org.springframework.boot' , module: 'spring-boot-starter-web'
  }

  compile group: 'org.springframework.cloud', name: 'spring-cloud-context', version: '1.3.5.RELEASE'

  compile group: 'ch.qos.logback', name: 'logback-classic', version: versions.logback
  compile group: 'ch.qos.logback', name: 'logback-core', version: versions.logback

  compile group: 'org.springframework.cloud', name: 'spring-cloud-starter-netflix-hystrix', version: versions.springHystrix
  compile group: 'org.springframework.cloud', name: 'spring-cloud-starter-netflix-hystrix-dashboard', version: versions.springHystrix

  compile group: 'org.flywaydb', name: 'flyway-core', version: '5.2.1'
  compile group: 'org.postgresql', name: 'postgresql', version: '42.2.6'

  compile("org.ff4j:ff4j-web:${versions.ff4j}") {
    exclude group: 'javax.servlet', module: 'jstl'
  }
  compile group: 'org.ff4j', name: 'ff4j-spring-boot-web-api', version: versions.ff4j
  compile group: 'org.ff4j', name: 'ff4j-store-springjdbc', version: versions.ff4j
  compile group: 'org.ff4j', name: 'ff4j-spring-boot-starter', version: versions.ff4j
  compile group: 'org.ff4j', name: 'ff4j-security-spring', version: versions.ff4j

  testCompile group: 'org.springframework.boot', name: 'spring-boot-starter-test', version: versions.springBoot
  testCompile group: 'org.mockito', name: 'mockito-core', version: '2.19.0' // remove once spring boot is v2

  integrationTestCompile sourceSets.main.runtimeClasspath
  integrationTestCompile sourceSets.test.runtimeClasspath
  integrationTestCompile group: 'org.testcontainers', name: 'postgresql', version: '1.12.0' //Remove explicit common-compress dependency when bumping this version.
  integrationTestCompile group: 'org.apache.commons', name: 'commons-compress', version: '1.19'
  integrationTestCompile group: 'org.springframework.security', name: 'spring-security-test', version: '4.2.12.RELEASE'

  functionalTestCompile sourceSets.main.runtimeClasspath
  functionalTestCompile group: 'io.rest-assured', name: 'rest-assured', version: '3.1.0'
  functionalTestCompile group: 'org.springframework.boot', name: 'spring-boot-starter-test', version: versions.springBoot
}

mainClassName = 'uk.gov.hmcts.reform.feature.Application'

jar {
  archiveName = 'feature-toggle-api.jar'

  manifest {
    attributes('Implementation-Version': project.version.toString())
  }
}

flyway {
  url = System.getenv('FLYWAY_URL')
  user = System.getenv('FLYWAY_USER')
  password = System.getenv('FLYWAY_PASSWORD')
  baselineOnMigrate = true
  baselineVersion = '000'
}

import org.flywaydb.gradle.task.FlywayMigrateTask

task migratePostgresDatabase(type: FlywayMigrateTask) {
  baselineOnMigrate = true
  if (project.hasProperty("dburl")) {
    url = "jdbc:postgresql://${dburl}"
  }
}