build.gradle

/*
 * Copyright OpenSearch Contributors
 * SPDX-License-Identifier: Apache-2.0
 */
import com.github.jk1.license.render.TextReportRenderer

buildscript {
    dependencies {
        classpath 'com.github.jk1:gradle-license-report:2.1'
    }
}

plugins {
    id 'com.diffplug.spotless' version '6.22.0'
    id 'io.spring.dependency-management' version '1.1.0'
}

apply from: file("${rootDir}/build-resources.gradle")
allprojects {
    apply plugin: 'checkstyle'
    apply plugin: 'com.diffplug.spotless'
    apply plugin: 'com.github.jk1.dependency-license-report'

    ext {
        mavenPublicationRootFile = file("${rootProject.buildDir}/m2")
    }

    spotless {
        format 'markdown', {
            target '*.md'
            // TODO: enrich format rules
            endWithNewline()
        }
        format 'misc', {
            target '.gitignore', '*.yml', '*.yaml'
            // TODO: enrich format rules
            trimTrailingWhitespace()
            endWithNewline()
        }
    }

    project.plugins.withType(JavaPlugin).configureEach {
        java {
            withJavadocJar()
            withSourcesJar()
        }
    }

    checkstyle {
        toolVersion = '10.12.3'
    }
}

subprojects {
    apply plugin: 'java'
    apply plugin: 'jacoco'

    java {
        toolchain {
            languageVersion = JavaLanguageVersion.of(11)
        }
    }

    spotless {
        java {
            targetExclude 'build/generated-src/antlr/**'
            // TODO: enrich format rules
            removeUnusedImports()
        }
    }
    dependencies {
        implementation platform('com.fasterxml.jackson:jackson-bom:2.17.2')
        implementation platform('org.eclipse.jetty:jetty-bom:9.4.53.v20231009')
        implementation platform('io.micrometer:micrometer-bom:1.10.5')
        implementation libs.guava.core
        implementation libs.slf4j.api
        testImplementation testLibs.bundles.junit
        testImplementation testLibs.bundles.mockito
        testImplementation testLibs.hamcrest
        testImplementation testLibs.awaitility
        constraints {
            implementation('dnsjava:dnsjava') {
                version {
                    require '3.6.1'
                }
                because 'Fixes CVE-2023-39410.'
            }
            implementation('org.apache.avro:avro') {
                version {
                    require '1.11.3'
                }
                because 'Fixes CVE-2023-39410.'
            }
            implementation('org.apache.commons:commons-configuration2') {
                version {
                    require '2.11.0'
                }
                because 'Fixes CVE-2024-29131 and CVE-2024-29133.'
            }
            implementation('org.apache.httpcomponents:httpclient') {
                version {
                    require '4.5.14'
                }
                because 'We want the newest version of httpclient.'
            }
            implementation('org.apache.logging.log4j:log4j-core') {
                version {
                    require '2.17.1'
                }
                because 'Log4j 2.17.1 fixes CVE-2021-44228, CVE-2021-45046, CVE-2021-45105, and CVE-2021-44832'
            }
            implementation('org.apache.logging.log4j:log4j-api') {
                version {
                    require '2.17.1'
                }
                because 'the build fails if the Log4j API is not update along with log4j-core'
            }
            implementation('org.apache.zookeeper:zookeeper') {
                version {
                    require '3.8.4'
                }
                because 'Fixes CVE-2024-23944, CVE-2023-44981'
            }
            implementation('com.google.code.gson:gson') {
                version {
                    require '2.8.9'
                }
                because 'Fixes WS-2021-0419 DoS vulnerability'
            }
            implementation('com.google.protobuf:protobuf-java') {
                version {
                    require '3.21.11'
                }
                because 'Fixes CVE-2022-3509, CVE-2022-3510'
            }
            implementation('org.yaml:snakeyaml') {
                version {
                    require '2.0'
                }
                because 'Fixes CVE-2022-1471'
            }
            implementation('org.codehaus.jettison:jettison') {
                version {
                    require '1.5.4'
                }
                because 'CVE from transitive dependecies'
            }
            implementation('net.minidev:json-smart') {
                version {
                    require '2.5.0'
                }
                because 'CVE from transitive dependencies'
            }
            implementation('org.jetbrains.kotlin:kotlin-stdlib') {
                version {
                    require '1.8.21'
                }
                because 'CVE from transitive dependencies'
            }
            implementation('org.eclipse.jetty:http2-common') {
                version {
                    require '9.4.53.v20231009'
                }
                because 'Fixes CVE-2023-44487'
            }
            implementation('org.eclipse.jetty:http2-server') {
                version {
                    require '9.4.53.v20231009'
                }
                because 'Fixes CVE-2023-44487'
            }
            implementation('org.xerial.snappy:snappy-java') {
                version {
                    require '1.1.10.5'
                }
                because 'Fixes CVE-2023-43642'
            }
            implementation('com.squareup.okio:okio-jvm') {
                version {
                    require '3.5.0'
                }
                because 'CVE from transitive dependencies'
            }
            implementation('com.charleskorn.kaml:kaml') {
                version {
                    require '0.55.0'
                }
                because 'CVE from transitive dependencies'
            }
            implementation('com.jayway.jsonpath:json-path') {
                version {
                    require '2.9.0'
                }
                because 'Fixes CVE-2023-51074 from transitive dependencies'
            }
            implementation('org.scala-lang:scala-library') {
                version {
                    require '2.13.12'
                }
                because 'CVE from transitive dependencies'
            }
            implementation('org.jline:jline') {
                version {
                    require '3.25.0'
                }
                because 'CVE-2023-50572'
            }
            implementation('org.json:json') {
                version {
                    require '20231013'
                }
                because 'CVE-2023-5072, CVE from transitive dependencies'
            }
            implementation('org.apache.commons:commons-compress') {
                version {
                    require '1.26.0'
                }
                because 'CVE-2024-25710, CVE-2024-26308'
            }
        }
    }

    configurations.all {
        resolutionStrategy.eachDependency { def details ->
            if (details.requested.group == 'io.netty') {
                if (details.requested.name == 'netty') {
                    details.useTarget group: 'io.netty', name: 'netty-all', version: '4.1.108.Final'
                    details.because 'Fixes CVE-2022-41881, CVE-2021-21290 and CVE-2022-41915.'
                } else if (!details.requested.name.startsWith('netty-tcnative')) {
                    details.useVersion '4.1.108.Final'
                    details.because 'Fixes CVE-2022-41881, CVE-2021-21290 and CVE-2022-41915.'
                }
            } else if (details.requested.group == 'log4j' && details.requested.name == 'log4j') {
                details.useTarget group: 'org.apache.logging.log4j', name: 'log4j-1.2-api', version: '2.17.1'
            } else if (details.requested.group == 'org.bouncycastle' && details.requested.name.endsWith('-jdk15on')) {
                def java8Name = details.requested.name.replace('-jdk15on', '-jdk18on')
                details.useTarget group: 'org.bouncycastle', name: java8Name, version: libs.bouncycastle.bcprov.get().version
                details.because 'Use only the Java 8 artifacts of BouncyCastle'
            }
        }
    }

    test {
        useJUnitPlatform()
        javaLauncher = javaToolchains.launcherFor {
            languageVersion = JavaLanguageVersion.current()
        }
        testLogging {
            exceptionFormat "full"
            showStackTraces false
        }
        reports {
            junitXml.required
            html.required
        }
    }

    build.dependsOn test
    jacocoTestReport {
        dependsOn test // tests are required to run before generating the report
        reports {
            xml.required
            html.required
        }
    }

    task allDeps(type: DependencyReportTask) {}
}

configure(subprojects.findAll {it.name != 'data-prepper-api'}) {
    dependencies {
        implementation platform('software.amazon.awssdk:bom:2.25.11')
        implementation 'jakarta.validation:jakarta.validation-api:3.0.2'
    }
}

configure(coreProjects) {
    jacocoTestReport {
        dependsOn test // tests are required to run before generating the report
        reports {
            xml.required
            csv.required
            html.destination file("${buildDir}/reports/jacocoHtml")
        }
    }
    test {
        finalizedBy jacocoTestReport // report is always generated after tests run
    }
    jacocoTestCoverageVerification {
        dependsOn jacocoTestReport
        violationRules {
            rule {
                limit {
                    minimum = 0.65 //TODO increase this to 0.75
                }
            }
        }
    }
    check.dependsOn jacocoTestCoverageVerification
}

task generateAggregateTestReport(type: TestReport) {
    destinationDirectory = file("${layout.buildDirectory}/reports/tests")
    reportOn subprojects*.test
}

licenseReport {
    excludeOwnGroup = true
    excludeBoms = true
    excludes = ['software.amazon.awssdk:bom']
    renderers = new TextReportRenderer()
}

task generateThirdPartyReport(type: Copy) {
    from 'build/reports/dependency-license/'
    into '.'
    include 'THIRD-PARTY-NOTICES.txt'
    rename 'THIRD-PARTY-NOTICES.txt', 'THIRD-PARTY'
    generateThirdPartyReport.dependsOn(generateLicenseReport)
}

// Utility method to recursively collect tasks from all projects and subprojects
def collectTasksRecursively(Project project, String taskName) {
    def tasks = []
    if (project.plugins.hasPlugin('java') || project.plugins.hasPlugin('java-library')) {
        Task task = project.tasks.findByName(taskName)
        if (task != null) {
            tasks.add(task)
        }
    }
    project.subprojects.each { subproject ->
        tasks += collectTasksRecursively(subproject, taskName)
    }
    return tasks
}

// Define a release task that depends on 'assemble' and 'publish' tasks of all nested projects within the coreProjects
task release {
    doLast {
        println "Release task completed."
    }
}

// Iterate over each core project and collect 'assemble' and 'publish' tasks recursively from them and their nested subprojects
coreProjects.each { coreProject ->
    // Ensure that the core project and its subprojects are evaluated
    evaluationDependsOn(coreProject.path)

    // Recursively collect 'assemble' and 'publishToMavenLocal' tasks for the core project
    def assembleTasks = collectTasksRecursively(coreProject, 'assemble')
    def publishTasks = collectTasksRecursively(coreProject, 'publish')

    // Explicitly declare release task for better gradle compatibility
    def releaseTask = tasks.named('release').get()
    releaseTask.dependsOn assembleTasks
    releaseTask.dependsOn publishTasks
}