build.gradle

plugins {
  id 'application'
  id 'idea'
  id 'jacoco'
  id 'io.spring.dependency-management' version '1.0.11.RELEASE'
  id 'org.springframework.boot' version '2.4.5'
  id 'org.owasp.dependencycheck' version '6.5.3'
  id 'com.github.ben-manes.versions' version '0.38.0'
  id 'org.sonarqube' version '3.1.1'
  id 'uk.gov.hmcts.java' version '0.12.2'
  id 'com.github.spacialcircumstances.gradle-cucumber-reporting' version '0.1.23'
}

group = 'uk.gov.hmcts.reform'
version = '0.0.1'

sourceCompatibility = 11
targetCompatibility = 11


sourceSets {
  functionalTest {
    java {
      compileClasspath += main.output
      runtimeClasspath += main.output
      srcDir file('src/functionalTest/java')
    }
    resources.srcDir file('src/functionalTest/resources')
  }

  integrationTest {
    java {
      compileClasspath += main.output
      runtimeClasspath += main.output
      srcDir file('src/integrationTest/java')
    }
    resources.srcDir file('src/integrationTest/resources')
  }
}

idea {
  module {
    // config to allow Intellij to mark test source and resource files correctly to help linting tools
    testSourceDirs += project.sourceSets.functionalTest.java.srcDirs
    testSourceDirs += project.sourceSets.integrationTest.java.srcDirs
    testResourceDirs += project.sourceSets.functionalTest.resources.srcDirs
    testResourceDirs += project.sourceSets.integrationTest.resources.srcDirs
  }
}

tasks.withType(JavaCompile) {
  options.compilerArgs << "-Xlint:unchecked" << "-Werror"
}

tasks.withType(Test) {
  useJUnitPlatform()

  testLogging {
    exceptionFormat = 'full'
  }
}

test {
  generateCucumberReports.enabled = false
  failFast = true
}

task functional(type: Test) {
  description = "Runs functional tests"
  group = "Verification"
  testClassesDirs = sourceSets.functionalTest.output.classesDirs
  classpath = sourceSets.functionalTest.runtimeClasspath

  generateCucumberReports.enabled = false

  doLast {
    generateCucumberReports.enabled = true

    javaexec {
      environment "OAUTH2_CLIENT_SECRET", "DUMMY"
      main = "uk.gov.hmcts.reform.hmc.hmi.befta.InboundAdapterBeftaMain"
      classpath += sourceSets.functionalTest.runtimeClasspath + sourceSets.main.output + sourceSets.test.output
      args = [
        '--strict',
        '--threads', '10',
        '--plugin', "json:${rootDir}/target/cucumber.json",
        '--plugin', "junit:${buildDir}/test-results/functional/cucumber.xml",
        '--tags', 'not @Ignore',
        '--glue', 'uk.gov.hmcts.befta.player', 'src/functionalTest/resources/features'
      ]
      // '--add-opens=...' added to suppress 'WARNING: An illegal reflective access operation has occurred' in uk.gov.hmcts.befta.util.CucumberStepAnnotationUtils
      jvmArgs = [ '--add-opens=java.base/java.lang.reflect=ALL-UNNAMED' ]
    }
  }

  finalizedBy {
    generateCucumberReports {
      doLast{
        delete "${rootDir}/BEFTA Report for Functional Tests/"
        new File("${rootDir}/BEFTA Report for Functional Tests").mkdirs()
        file("${rootDir}/target/cucumber/cucumber-html-reports").renameTo(file("${rootDir}/BEFTA Report for Functional Tests"))
        logger.quiet("Functional test report moved to ---> file://${rootDir}/BEFTA%20Report%20for%20Functional%20Tests/overview-features.html")
      }
    }
  }
  outputs.upToDateWhen { false }
}

task integration(type: Test) {
  description = "Runs integration tests"
  group = "Verification"
  testClassesDirs = sourceSets.integrationTest.output.classesDirs
  classpath = sourceSets.integrationTest.runtimeClasspath
  failFast = true
}

task smoke(type: Test) {
  description = 'Executes smoke tests against an the HMC HMI Inbound Adapter API instance just deployed'
  dependsOn functionalTestClasses

  new File("$buildDir/test-results/test").mkdirs()
  copy {
    from "src/functional/resources/DummyTest.xml"
    into "$buildDir/test-results/test"
  }

  doLast {
    generateCucumberReports.enabled = true
    javaexec {
      environment "OAUTH2_CLIENT_SECRET", "DUMMY"
      main = "uk.gov.hmcts.reform.hmc.hmi.befta.InboundAdapterBeftaMain"
      classpath += sourceSets.functionalTest.runtimeClasspath + sourceSets.main.output + sourceSets.test.output
      args = [
        '--strict',
        '--threads', '10',
        '--plugin', "json:${rootDir}/target/cucumber.json",
        '--plugin', "junit:${buildDir}/test-results/functional/cucumber.xml",
        '--tags', '@Smoke and not @Ignore',
        '--glue', 'uk.gov.hmcts.befta.player', 'src/functionalTest/resources/features'
      ]
      // '--add-opens=...' added to suppress 'WARNING: An illegal reflective access operation has occurred' in uk.gov.hmcts.befta.util.CucumberStepAnnotationUtils
      jvmArgs = [ '--add-opens=java.base/java.lang.reflect=ALL-UNNAMED' ]
    }
  }

  finalizedBy {
    generateCucumberReports {
      doLast{
        delete "${rootDir}/BEFTA Report for Smoke Tests/"
        new File("${rootDir}/BEFTA Report for Smoke Tests").mkdirs()
        file("${rootDir}/target/cucumber/cucumber-html-reports").renameTo(file("${rootDir}/BEFTA Report for Smoke Tests"))

        logger.quiet("Smoke test report moved to ---> file://${rootDir}/BEFTA%20Report%20for%20Smoke%20Tests/overview-features.html")
      }
    }
  }

  outputs.upToDateWhen { false }
}

cucumberReports {
  outputDir = file("${rootDir}/target/cucumber")
  reports = files("${rootDir}/target/cucumber.json")
}

task customCleanBeftaReports(type:Delete) {
  delete "${rootDir}/BEFTA Report for Smoke Tests/"
  delete "${rootDir}/BEFTA Report for Functional Tests/"
  delete "${rootDir}/target/cucumber"
  delete "${rootDir}/target/cucumber.json"
}
tasks.clean.dependsOn(tasks.customCleanBeftaReports)

jacocoTestReport {
  executionData(test, integration)
  reports {
    xml.enabled = true
    csv.enabled = false
    xml.destination file("${buildDir}/reports/jacoco/test/jacocoTestReport.xml")
  }
}

project.tasks['sonarqube'].dependsOn jacocoTestReport

sonarqube {
  properties {
    property "sonar.projectName", "Reform :: hmc-hmi-inbound-adapter"
    property "sonar.projectKey", "uk.gov.hmcts.reform:hmc-hmi-inbound-adapter"
    property "sonar.coverage.jacoco.xmlReportPaths", "${jacocoTestReport.reports.xml.destination.path}"
    property "sonar.exclusions", "src/main/java/uk/gov/hmcts/reform/hmc/Application.java," +
    "src/main/java/uk/gov/hmcts/reform/hmc/config/MessageReceiverConfiguration.java,**/config/SecurityConfiguration.java"
  }
}

def versions = [
  junit           : '5.7.1',
  junitPlatform   : '1.7.1',
  lombok          : '1.18.8',
  mapstruct       : '1.4.2.Final',
  reformLogging   : '5.1.9',
  serviceAuth     : '4.0.3',
  springBoot      : springBoot.class.package.implementationVersion,
  springCloud     : '2020.0.1',
  springfoxSwagger: '3.0.0',
  testcontainers  : '1.15.2',
  jetty           : '9.4.43.v20210629',
  netty           : '4.1.77.Final'
]

ext['spring-framework.version'] = '5.3.21'
ext['spring-security.version'] = '5.7.2'
ext['log4j2.version'] = '2.17.1'
ext['jackson.version'] = '2.13.2'

// before committing a change, make sure task still works
dependencyUpdates {
  def isNonStable = { String version ->
    def stableKeyword = ['RELEASE', 'FINAL', 'GA'].any { qualifier -> version.toUpperCase().contains(qualifier) }
    def regex = /^[0-9,.v-]+$/
    return !stableKeyword && !(version ==~ regex)
  }
  rejectVersionIf { selection -> // <---- notice how the closure argument is named
    return isNonStable(selection.candidate.version) && !isNonStable(selection.currentVersion)
  }
}

dependencyCheck {
  suppressionFile = 'config/owasp/suppressions.xml'
}

dependencyManagement {
  dependencies {
    dependency group: 'org.bouncycastle', name: 'bcpkix-jdk15on', version: '1.68'
    // CVE-2018-10237 - Unbounded memory allocation
    dependencySet(group: 'com.google.guava', version: '30.1.1-jre') {
      entry 'guava'
    }
    // Remove once BEFTA rest-assured is updated
    dependencySet(group: 'io.rest-assured', version: '4.3.0') {
      entry 'json-path'
      entry 'xml-path'
    }
    dependencySet(group: 'org.apache.tomcat.embed', version: '9.0.63') {
      entry 'tomcat-embed-core'
      entry 'tomcat-embed-el'
      entry 'tomcat-embed-websocket'
    }
    //CVE-2021-22044
    dependencySet(group: 'org.springframework.cloud', version: '3.0.5') {
      entry 'spring-cloud-openfeign-core'
      entry 'spring-cloud-starter-openfeign'
      entry 'spring-cloud-starter-contract-stub-runner'
    }
  }
}

cucumberReports {
  outputDir = file("${projectDir}/target/cucumber")
  reports = files("${projectDir}/target/cucumber.json")
  notFailingStatuses = ["skipped", "passed"]
}

repositories {
  mavenLocal()
  mavenCentral()
  maven {
    url "https://jitpack.io"
  }
}

ext.libraries = [
  junit5: [
    "org.junit.jupiter:junit-jupiter-api:${versions.junit}",
    "org.junit.jupiter:junit-jupiter-engine:${versions.junit}",
    "org.junit.jupiter:junit-jupiter-params:${versions.junit}",
    "org.junit.platform:junit-platform-commons:${versions.junitPlatform}",
    "org.junit.platform:junit-platform-engine:${versions.junitPlatform}"
  ]
]

dependencies {
  compile "com.fasterxml.jackson.core:jackson-databind:2.13.2.2"
  implementation group: 'org.springframework.boot', name: 'spring-boot-starter-validation'
  implementation group: 'org.springframework.boot', name: 'spring-boot-starter-web'
  implementation group: 'org.springframework.boot', name: 'spring-boot-starter-actuator'
  implementation group: 'org.springframework.boot', name: 'spring-boot-starter-aop'
  implementation group: 'org.springframework.boot', name: 'spring-boot-starter-json'
  implementation group: 'org.springframework.boot', name: 'spring-boot-starter-data-jpa'
  implementation group: 'org.springframework.boot', name: 'spring-boot-starter-cache'
  implementation group: 'org.springframework.boot', name: 'spring-boot-starter-security' , version: '2.6.4'
  implementation group: 'org.springframework.cloud', name: 'spring-cloud-starter-openfeign' ,
    {
      exclude group: "org.springframework.security", module: "spring-security-crypto"
    }
  implementation group: 'io.springfox', name: 'springfox-swagger2', version: versions.springfoxSwagger

  implementation group: 'com.github.hmcts.java-logging', name: 'logging', version: versions.reformLogging
  implementation group: 'com.github.hmcts.java-logging', name: 'logging-appinsights', version: versions.reformLogging

  implementation group: 'com.github.hmcts', name: 'service-auth-provider-java-client', version: versions.serviceAuth
  implementation group: 'com.github.hmcts', name: 'idam-java-client', version: '2.0.1'

  implementation group: 'com.azure', name: 'azure-messaging-servicebus', version: '7.8.0'
  implementation group: 'com.azure', name: 'azure-core', version: '1.28.0'
  implementation group: "com.github.ben-manes.caffeine", name: "caffeine", version: "3.0.6"

  implementation group: 'net.minidev', name: 'json-smart', version: '2.4.7'

  // Explicitly specify version of jakarta.el to be used to resolve CVE-2021-28170
  implementation group: 'org.glassfish', name: 'jakarta.el', version: '4.0.1'
  compile "org.glassfish:javax.el:3.0.0"

  // CVE-2021-42550
  implementation group: 'ch.qos.logback', name: 'logback-classic', version: '1.2.10'
  implementation group: 'ch.qos.logback', name: 'logback-core', version: '1.2.10'

  implementation group: 'commons-io', name: 'commons-io', version: '2.8.0'

  implementation group: 'org.projectlombok', name: 'lombok', version: versions.lombok
  annotationProcessor group: 'org.projectlombok', name: 'lombok', version: versions.lombok

  implementation group: 'org.eclipse.jetty', name: 'jetty-server', version: versions.jetty
  implementation group: 'org.eclipse.jetty', name: 'jetty-alpn-client', version: versions.jetty
  implementation group: 'org.eclipse.jetty', name: 'jetty-continuation', version: versions.jetty
  implementation group: 'org.eclipse.jetty', name: 'jetty-util', version: versions.jetty
  implementation group: 'org.eclipse.jetty', name: 'jetty-util-ajax', version: versions.jetty
  implementation group: 'org.eclipse.jetty', name: 'jetty-xml', version: versions.jetty
  implementation group: 'org.eclipse.jetty', name: 'jetty-client', version: versions.jetty
  implementation group: 'org.eclipse.jetty', name: 'jetty-security', version: versions.jetty
  implementation group: 'org.eclipse.jetty', name: 'jetty-http', version: versions.jetty
  implementation group: 'org.eclipse.jetty', name: 'jetty-io', version: versions.jetty
  implementation group: 'org.eclipse.jetty.http2', name: 'http2-server', version: versions.jetty
  implementation group: 'org.eclipse.jetty.http2', name: 'http2-common', version: versions.jetty
  implementation group: 'org.eclipse.jetty', name: 'jetty-servlet', version: versions.jetty
  implementation group: 'org.eclipse.jetty', name: 'jetty-servlets', version: versions.jetty
  implementation group: 'org.eclipse.jetty', name: 'jetty-webapp', version: versions.jetty
  implementation group: 'org.eclipse.jetty', name: 'jetty-proxy', version: versions.jetty
  implementation group: 'org.eclipse.jetty', name: 'jetty-alpn-server', version: versions.jetty
  implementation group: 'org.eclipse.jetty', name: 'jetty-alpn-conscrypt-server', version: versions.jetty
  implementation group: 'org.eclipse.jetty', name: 'jetty-alpn-conscrypt-client', version: versions.jetty

  // CVE-2021-43797, CVE-2021-21290
  implementation group: 'io.netty', name: 'netty-buffer', version: versions.netty
  implementation group: 'io.netty', name: 'netty-codec', version: versions.netty
  implementation group: 'io.netty', name: 'netty-codec-dns', version: versions.netty
  implementation group: 'io.netty', name: 'netty-codec-http', version: versions.netty
  implementation group: 'io.netty', name: 'netty-codec-http2', version: versions.netty
  implementation group: 'io.netty', name: 'netty-codec-socks', version: versions.netty
  implementation group: 'io.netty', name: 'netty-common', version: versions.netty
  implementation group: 'io.netty', name: 'netty-handler', version: versions.netty
  implementation group: 'io.netty', name: 'netty-handler-proxy', version: versions.netty
  implementation group: 'io.netty', name: 'netty-resolver', version: versions.netty
  implementation group: 'io.netty', name: 'netty-resolver-dns', version: versions.netty
  implementation group: 'io.netty', name: 'netty-resolver-dns-native-macos', version: versions.netty
  implementation group: 'io.netty', name: 'netty-transport', version: versions.netty
  implementation group: 'io.netty', name: 'netty-transport-native-epoll', version: versions.netty
  implementation group: 'io.netty', name: 'netty-transport-native-kqueue', version: versions.netty
  implementation group: 'io.netty', name: 'netty-transport-native-unix-common', version: versions.netty

  testImplementation libraries.junit5
  testImplementation group: 'org.springframework.boot', name: 'spring-boot-starter-test', {
    exclude group: 'junit', module: 'junit'
    exclude group: 'org.junit.vintage', module: 'junit-vintage-engine'
  }

  testImplementation group: 'org.mockito', name: 'mockito-inline', version: '3.11.1'
  testImplementation group: 'org.powermock', name: 'powermock-module-junit4', version: '2.0.9'

  testImplementation group: 'com.github.tomakehurst', name: 'wiremock', version: '2.27.2'

  testImplementation group: 'org.springframework.cloud', name: 'spring-cloud-starter-contract-stub-runner'
  integrationTestImplementation sourceSets.main.runtimeClasspath
  integrationTestImplementation sourceSets.test.runtimeClasspath

  functionalTestImplementation sourceSets.main.runtimeClasspath
  functionalTestImplementation group: 'com.github.hmcts', name: 'befta-fw', version: '8.7.1'
  functionalTestImplementation libraries.junit5

  testCompile 'com.github.hmcts:fortify-client:1.2.0:all'
}

configurations.implementation {
  exclude group: "org.springframework.security", module: "spring-security-rsa"
}

mainClassName = 'uk.gov.hmcts.reform.hmc.Application'

bootJar {
  getArchiveFileName().set(provider {
    'hmc-hmi-inbound-adapter.jar'
  })

  manifest {
    attributes('Implementation-Version': project.version.toString())
  }
}

wrapper {
  distributionType = Wrapper.DistributionType.ALL
}

task fortifyScan(type: JavaExec)  {
  main = "uk.gov.hmcts.fortifyclient.FortifyClientMainApp"
  classpath += sourceSets.test.runtimeClasspath
  jvmArgs = ['--add-opens=java.base/java.lang.reflect=ALL-UNNAMED']
  // The line below prevents the build from failing if the Fortify scan detects issues
  ignoreExitValue = true
}