build.gradle

/*******************************************************************************
 * (c) Copyright 2020 Micro Focus or one of its affiliates
 *
 * Permission is hereby granted, free of charge, to any person obtaining a 
 * copy of this software and associated documentation files (the 
 * "Software"), to deal in the Software without restriction, including without 
 * limitation the rights to use, copy, modify, merge, publish, distribute, 
 * sublicense, and/or sell copies of the Software, and to permit persons to 
 * whom the Software is furnished to do so, subject to the following 
 * conditions:
 * 
 * The above copyright notice and this permission notice shall be included 
 * in all copies or substantial portions of the Software.
 * 
 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY 
 * KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE 
 * WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR 
 * PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE 
 * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, 
 * DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF 
 * CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN 
 * CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS 
 * IN THE SOFTWARE.
 ******************************************************************************/

plugins {
	id "org.springframework.boot" version "2.7.18"
	id 'com.github.jk1.dependency-license-report' version '2.6'
	id "org.kordamp.gradle.markdown" version "2.2.0"
	id 'com.google.cloud.tools.jib' version '3.4.1'
	id "io.freefair.lombok" version "8.6"
	id 'eclipse'
}

// Apply 'java' plugin for root project, 'java-library' plugin for sub-projects
apply plugin: 'java'
subprojects {
	apply plugin: 'java-library'
	jar {
		archiveFileName = "${archiveBaseName.get()}.${archiveExtension.get()}"
		from {
			configurations.runtimeClasspath.collect { it.isDirectory() ? it : zipTree(it) }
		}
	}
}

// Set up source compatibility and JUnit for all projects 
allprojects {
	sourceCompatibility = 1.8
	test {
		useJUnitPlatform()
	}
	configurations {
        eclipseExtraClasspath.extendsFrom compileOnly
    }
    eclipse {
        classpath {
            plusConfigurations += [ configurations.eclipseExtraClasspath ]
        }
    }
}

// Set up Gradle helpers, group and version for all projects
allprojects {
	ext {
		gradleHelpersLocation = "https://raw.githubusercontent.com/fortify/shared-gradle-helpers/1.8"
	}

	apply from: "${gradleHelpersLocation}/repo-helper.gradle"
	group = 'com.fortify.export.vulnerabilities'
}

// Set up dependency management for all projects
allprojects {
	dependencies {
		implementation platform('com.fortify.client.api:fortify-client-api-bom:6.1.8.RELEASE')
		implementation platform(org.springframework.boot.gradle.plugin.SpringBootPlugin.BOM_COORDINATES)
		
		constraints {
			implementation 'javax.validation:validation-api:2.0.1.Final'
			implementation 'org.hibernate:hibernate-validator:6.2.5.Final'
			implementation 'org.hibernate:hibernate-validator-annotation-processor:6.2.5.Final'
			implementation 'org.jsoup:jsoup:1.17.2'
			implementation 'com.google.code.findbugs:jsr305:3.0.2'
			// Spring Boot declares dependency on snakeyaml 1.30, which contains known 
			// vulnerabilities. According to https://stackoverflow.com/a/75875594, our 
			// Spring Boot version is compatible with snakeyaml 2.0, which doesn't have 
			// any known vulnerabilities, so we override the version here.
			implementation 'org.yaml:snakeyaml:2.2'
		}
	}
}

// Include all dependencies used by main app and dependencies provided to plugin implementations 
dependencies {
	implementation project(':FortifyVulnerabilityExporter-api')
	runtimeOnly project(':FortifyVulnerabilityExporter-spi-from')
	runtimeOnly project(':FortifyVulnerabilityExporter-spi-to')
	runtimeOnly project(':FortifyVulnerabilityExporter-plugin-from-fod')
	runtimeOnly project(':FortifyVulnerabilityExporter-plugin-from-ssc')
	runtimeOnly project(':FortifyVulnerabilityExporter-plugin-raw')
	runtimeOnly project(':FortifyVulnerabilityExporter-plugin-to-csv')
	runtimeOnly project(':FortifyVulnerabilityExporter-plugin-to-json')
	implementation 'com.fortify.client.api:common-log'
	implementation 'com.fortify.client.api:common-spring'
	implementation 'com.fortify.client.api:common-rest'
	implementation 'commons-lang:commons-lang'
	implementation 'commons-collections:commons-collections'
	implementation 'org.springframework.boot:spring-boot-starter-quartz'
	implementation 'javax.validation:validation-api'
	implementation 'org.hibernate:hibernate-validator'
	implementation 'org.hibernate:hibernate-validator-annotation-processor'
	implementation 'org.jsoup:jsoup'
    // Required for Java 8 date/time handling
    implementation 'com.fasterxml.jackson.datatype:jackson-datatype-jsr310'
	testImplementation('org.springframework.boot:spring-boot-starter-test')
}

bootJar {
	archiveFileName = "${archiveBaseName.get()}.${archiveExtension.get()}"
	manifest {
		// We use PropertiesLauncher together with custom loader.properties
		// to allow 3rd-party plugins to be loaded from an external directory.
		attributes(
			'Main-Class':             'org.springframework.boot.loader.PropertiesLauncher',
			'Implementation-Title':   "${project.name}",
			'Implementation-Version': "${project.version}"
        )
	}
}

ext {
	thirdPartyBaseName = "${rootProject.name}"
}
apply from: "${gradleHelpersLocation}/thirdparty-helper.gradle"
apply from: "${gradleHelpersLocation}/markdown2html.gradle"

configurations.all {
    // Don't cache modules that may change (i.e. snapshots)
	resolutionStrategy.cacheChangingModulesFor 0, 'seconds'
}

task copyMarkdown(type: Copy) {
	from("${projectDir}") {
		include "USAGE.md"
	}
	into "${m2hSourceDir}"
 }

task dist(type: Zip) {
	dependsOn 'build', 'markdownToHtml'
	archiveFileName = "${rootProject.name}.zip"
	destinationDirectory = file("$buildDir/dist")
	from "${m2hOutputDir}"
	from("${projectDir}") {
		include "config/**/*"
		include "LICENSE.txt"
	}
	from("${buildDir}/${libsDirName}") {
		include "${rootProject.name}.jar"
	}
}

task copyExtraJibFiles(type: Copy) {
	into "${buildDir}/jibExtraFiles"
	into("config") {
	    // Pre-populate /config directory to avoid copying configuration files if no bind mounts are used
		from "${projectDir}/config"
	}
	into("default/config") { 
	    // If /config doesn't exist or is empty (for example because a bind mount is used),
	    // the PopulateContainerDirs class will copy config files from /default/config to /config
		from "${projectDir}/config"
	}
}

gradle.taskGraph.whenReady { graph ->
    if (graph.hasTask(':jib')) {
    	if (!project.hasProperty('jibImageTag')) {
        	throw new GradleException("Property jibImageTag must be set when executing jib task")
        }
    	def jibExtraImageTagsString = project.properties["jibExtraImageTags"]?.trim()
    	if ( jibExtraImageTagsString ) {
    		jib.to.tags = jibExtraImageTagsString.split(',') as List
    	}
    } 
}

// Configuration for jar-file used by jib
jar {
	manifest {
		attributes(
			'Implementation-Title':   "${project.name}",
			'Implementation-Version': "${project.version}"
        )
	}
}

jib {
	from {
		image = "eclipse-temurin:11-jre"
	}
	to {
		image = "fortifydocker/fortify-vulnerability-exporter:${project.properties['jibImageTag']}"
		auth {
			username = System.getenv('DOCKER_HUB_USER') ?: ''
			password = System.getenv('DOCKER_HUB_TOKEN') ?: ''
		}
		extraDirectories {
			paths = ['src/main/jib', "${buildDir}/jibExtraFiles"]
			permissions = [
				// Read/write/execute for all, to allow container to run as any user
				'/config': '777', 
				'/work': '777'
	        ]
		}
		container {
			jvmFlags = ['-DpopulateContainerDirs=true']
			volumes = ['/config', '/export']
			environment = [EXPORT_DEFAULT_DIR:'/export']
		}
		containerizingMode = 'packaged'
	}
}
tasks.jib.dependsOn 'copyExtraJibFiles'
tasks.jibBuildTar.dependsOn copyExtraJibFiles