build.gradle

import org.gradle.api.tasks.testing.logging.TestExceptionFormat
import org.gradle.api.tasks.testing.logging.TestLogEvent

buildscript {
    repositories {
        mavenLocal()
        mavenCentral()
    }
}

plugins {
    id "checkstyle"
    id "java"
    id "maven-publish"
    id "idea"
    id "jacoco"
    id "org.springframework.boot" version "${spring_boot_version}"
    id "io.spring.dependency-management" version "1.1.4"
    id "com.google.cloud.tools.jib" version "3.4.2"
    id "com.github.node-gradle.node" version "${gradle_node_plugin_version}"
    id "com.diffplug.spotless" version "6.25.0"
    // this allows us to find outdated dependencies via ./gradlew dependencyUpdates
    id "com.github.ben-manes.versions" version "0.51.0"
    id "com.github.andygoossens.modernizer" version "${modernizer_plugin_version}"
    id "com.gorylenko.gradle-git-properties" version "2.4.1"
    id "org.owasp.dependencycheck" version "9.1.0"
    id "com.adarshr.test-logger" version "4.0.0"
}

group = "de.tum.in.www1.artemis"
version = "7.0.2"
description = "Interactive Learning with Individual Feedback"

java {
    sourceCompatibility = JavaVersion.VERSION_21
    targetCompatibility = JavaVersion.VERSION_21
}

//this enables us to invoke ./gradlew liquibaseDiffChangelog
apply from: "gradle/liquibase.gradle"

if (project.hasProperty("prod")) {
    apply from: "gradle/profile_prod.gradle"
} else {
    apply from: "gradle/profile_dev.gradle"
}

if (project.hasProperty("war")) {
    apply from: "gradle/war.gradle"
}

apply plugin: "jacoco"

idea {
    module {
        excludeDirs += files("node_modules")
    }
}

spotless {
    // allows to execute the code formatting commands ./gradlew spotlessApply and ./gradlew spotlessCheck
    java {
        target {
            fileTree(rootDir) {
                include "**/*.java"
                exclude(
                        "**/src/test/resources/test-data/repository-export/EncodingISO_8559_1.java",
                        "**/node_modules/**",
                        "**/out/**",
                        "**/repos/**",
                        "**/repos-download/**",
                        "**/build/**",
                        "**/src/main/generated/**",
                        "**/src/main/resources/templates/**",
                        "/docker/**",
                        "checked-out-repos/**",
                        "**/src/main/java/org/eclipse/**"
                )
            }
        }
        importOrderFile "artemis-spotless.importorder"
        eclipse("4.28").configFile "artemis-spotless-style.xml"

        removeUnusedImports()
        trimTrailingWhitespace()
    }
}

defaultTasks "bootRun"

springBoot {
    mainClass = "de.tum.in.www1.artemis.ArtemisApp"
}

modernizer {
    failOnViolations = false
    includeTestClasses = true
    // Copy the rule name as defined in https://github.com/gaul/modernizer-maven-plugin/blob/master/modernizer-maven-plugin/src/main/resources/modernizer.xml to exclude it
    exclusions = ["java/util/Optional.get:()Ljava/lang/Object;"]
}

// Execute the test cases: ./gradlew test
// Execute only architecture tests: ./gradlew test -DincludeTags="ArchitectureTest"
test {
    if (System.getProperty("includeTags")) {
        useJUnitPlatform {
            includeTags System.getProperty("includeTags")
        }
    } else {
        useJUnitPlatform()
        exclude "**/*IT*", "**/*IntTest*"
    }

    testLogging {
        events "FAILED", "SKIPPED"
    }
    testLogging.showStandardStreams = true
    reports.html.required = false
    minHeapSize = "1024m" // initial heap size
    maxHeapSize = "3072m" // maximum heap size
}

tasks.register("testReport", TestReport) {
    destinationDirectory = layout.buildDirectory.file("reports/tests").get().asFile
    testResults.from(test)
}

jacoco {
    toolVersion = "0.8.11"
}

jar {
    enabled = false
}

private excludedClassFilesForReport(classDirectories) {
    classDirectories.setFrom(files(classDirectories.files.collect {
        fileTree(dir: it,
                exclude: [
                        "**/de/tum/in/www1/artemis/domain/**/*_*",
                        "**/de/tum/in/www1/artemis/config/migration/entries/**",
                        "**/org/eclipse/jgit/**",
                        "**/gradle-wrapper.jar/**"
                ]
        )
    }))
}

jacocoTestReport {
    reports {
        xml.required = true
    }
    // we want to ignore some generated files in the domain folders
    afterEvaluate {
        excludedClassFilesForReport(classDirectories)
    }
}

jacocoTestCoverageVerification {
    violationRules {
        rule {
            limit {
                counter = "INSTRUCTION"
                value = "COVEREDRATIO"
                minimum = 0.88
            }
            limit {
                counter = "CLASS"
                value = "MISSEDCOUNT"
                // TODO: in the future the following value should become less than 10
                maximum = 34
            }
        }
    }
    // we want to ignore some generated files in the domain folders
    afterEvaluate {
        excludedClassFilesForReport(classDirectories)
    }
}
check.dependsOn jacocoTestCoverageVerification

configurations {
    providedRuntime
}

repositories {
    mavenLocal()
    mavenCentral()
    maven {
        url "https://repo.gradle.org/gradle/libs-releases/"
    }
    maven {
        url "https://build.shibboleth.net/maven/releases/"
    }
}

ext["jackson.version"] = fasterxml_version
ext["junit-jupiter.version"] = junit_version

dependencies {

    // Note: jenkins-client is not well maintained and includes dependencies to libraries with critical security issues (e.g. CVE-2020-10683 for dom4j@1.6.1)
    //    implementation "com.offbytwo.jenkins:jenkins-client:0.3.8"
    implementation files("libs/jenkins-client-0.4.0.jar")
    // The following 4 dependencies are explicitly integrated as transitive dependencies of jenkins-client-0.4.0.jar
    implementation "org.apache.httpcomponents.client5:httpclient5:5.3.1"
    implementation "org.apache.httpcomponents.core5:httpcore5:5.2.4"
    implementation "org.apache.httpcomponents:httpmime:4.5.14"
    implementation("org.dom4j:dom4j:2.1.4") {
        // Note: avoid org.xml.sax.SAXNotRecognizedException: unrecognized feature http://xml.org/sax/features/external-general-entities
        // also see https://github.com/dom4j/dom4j/issues/99
        exclude module: "pull-parser"
        exclude module: "jaxen"
        exclude module: "xpp3"
        exclude module: "xsdlib"
        exclude module: "stax-api"
        exclude module: "jaxb-api"
    }

    implementation "org.gitlab4j:gitlab4j-api:6.0.0-rc.4"

    implementation "de.jplag:jplag:${jplag_version}"
    implementation "de.jplag:java:${jplag_version}"
    implementation "de.jplag:kotlin:${jplag_version}"
    implementation "de.jplag:c:${jplag_version}"
    implementation "de.jplag:swift:${jplag_version}"
    implementation "de.jplag:java:${jplag_version}"
    implementation "de.jplag:python-3:${jplag_version}"
    implementation "de.jplag:text:${jplag_version}"

    // we have to override those values to use the latest version
    implementation "org.slf4j:jcl-over-slf4j:${slf4j_version}"
    implementation "org.slf4j:jul-to-slf4j:${slf4j_version}"
    implementation("org.slf4j:slf4j-api") {
        version {
            strictly "${slf4j_version}"
        }
    }

    implementation "org.apache.logging.log4j:log4j-to-slf4j:2.23.1"

    // Note: spring-security-lti13 does not work with jakarta yet, so we built our own custom version and declare its transitive dependencies below
    // implementation "uk.ac.ox.ctl:spring-security-lti13:0.1.11"
    implementation files("libs/spring-security-lti13-0.1.12.jar")

    // https://search.maven.org/artifact/org.eclipse.jgit/org.eclipse.jgit
    implementation "org.eclipse.jgit:org.eclipse.jgit:${jgit_version}"
    implementation "org.eclipse.jgit:org.eclipse.jgit.ssh.apache:${jgit_version}"
    // Note: jgit.htt.server is not compatible with jakarta yet and neither is there a timeline. Hence, we had to add the sourcefiles to our repository. Once the compatibility is given, we can switch back to the maven dependency.
    // implementation "org.eclipse.jgit:org.eclipse.jgit.http.server:${jgit_version}"

    implementation "oauth.signpost:signpost-core:2.1.1"
    implementation "oauth.signpost:signpost-commonshttp4:2.1.1"

    // https://mvnrepository.com/artifact/net.sourceforge.plantuml/plantuml
    implementation "net.sourceforge.plantuml:plantuml:1.2024.4"
    implementation "org.jasypt:jasypt:1.9.3"
    implementation "me.xdrop:fuzzywuzzy:1.4.0"
    implementation("org.yaml:snakeyaml") {
        version {
            strictly "2.2"
            // needed to reduce the number of vulnerabilities, also see https://mvnrepository.com/artifact/org.yaml/snakeyaml
        }
    }

    implementation "com.thoughtworks.qdox:qdox:2.1.0"
    implementation "io.sentry:sentry-logback:${sentry_version}"
    implementation "io.sentry:sentry-spring-boot-starter-jakarta:${sentry_version}"

    // NOTE: the following six dependencies use the newer versions explicitly to avoid other dependencies to use older versions
    implementation "ch.qos.logback:logback-classic:${logback_version}"
    implementation "ch.qos.logback:logback-core:${logback_version}"
    implementation "com.thoughtworks.xstream:xstream:1.4.20"
    implementation "xerces:xercesImpl:2.12.2"
    implementation "xalan:xalan:2.7.3"
    implementation "xalan:serializer:2.7.3"

    // NOTE: use the latest 2.x version to avoid security vulnerabilities, upgrade to 4.x not possible yet
    implementation "org.apache.santuario:xmlsec:2.3.4"

    implementation "org.jsoup:jsoup:1.17.2"
    implementation "commons-codec:commons-codec:1.16.1"   // needed for spring security saml2

    implementation "org.springdoc:springdoc-openapi-ui:1.8.0"
    implementation "com.vdurmont:semver4j:3.1.0"

    implementation "com.github.docker-java:docker-java-core:${docker_java_version}"
    implementation "com.github.docker-java:docker-java-transport-httpclient5:${docker_java_version}"

    // use newest version of commons-compress to avoid security issues through outdated dependencies
    implementation "org.apache.commons:commons-compress:1.26.1"


    // import JHipster dependencies BOM
    implementation platform("tech.jhipster:jhipster-dependencies:${jhipster_dependencies_version}")

    implementation "tech.jhipster:jhipster-framework:${jhipster_dependencies_version}"
    implementation "org.springframework.boot:spring-boot-starter-cache:${spring_boot_version}"
    implementation "io.micrometer:micrometer-registry-prometheus:1.12.5"
    implementation "net.logstash.logback:logstash-logback-encoder:7.4"

    // Defines low-level streaming API, and includes JSON-specific implementations
    implementation "com.fasterxml.jackson.core:jackson-core:${fasterxml_version}"
    // Contains standard Jackson annotations
    implementation "com.fasterxml.jackson.core:jackson-annotations:${fasterxml_version}"
    // Implements data-binding (and object serialization) support
    implementation "com.fasterxml.jackson.core:jackson-databind:${fasterxml_version}"
    // Support for "Java 8 Dates"
    implementation "com.fasterxml.jackson.datatype:jackson-datatype-jsr310:${fasterxml_version}"
    // Support JSON serialization and deserialization of Hibernate (https://hibernate.org) specific data types and properties; especially lazy-loading aspects
    implementation "com.fasterxml.jackson.datatype:jackson-datatype-hibernate6:${fasterxml_version}"

    implementation "com.hazelcast:hazelcast:${hazelcast_version}"
    implementation "com.hazelcast:hazelcast-spring:${hazelcast_version}"
    implementation "com.hazelcast:hazelcast-hibernate53:5.1.0"
    implementation "javax.cache:cache-api:1.1.1"
    implementation "org.hibernate.orm:hibernate-core:${hibernate_version}"
    implementation "com.zaxxer:HikariCP:5.1.0"
    implementation "org.apache.commons:commons-text:1.12.0"
    implementation "org.apache.commons:commons-math3:3.6.1"
    implementation "javax.transaction:javax.transaction-api:1.3"
    implementation "org.liquibase:liquibase-core:${liquibase_version}"
    implementation "org.springframework.boot:spring-boot-starter-validation:${spring_boot_version}"
    implementation "org.springframework.boot:spring-boot-loader-tools:${spring_boot_version}"
    implementation "org.springframework.boot:spring-boot-starter-mail:${spring_boot_version}"
    implementation "org.springframework.boot:spring-boot-starter-logging:${spring_boot_version}"
    implementation "org.springframework.boot:spring-boot-starter-actuator:${spring_boot_version}"
    implementation "org.springframework.boot:spring-boot-starter-aop:${spring_boot_version}"
    implementation "org.springframework.boot:spring-boot-starter-data-jpa:${spring_boot_version}"
    implementation "org.springframework.boot:spring-boot-starter-security:${spring_boot_version}"
    implementation("org.springframework.boot:spring-boot-starter-web:${spring_boot_version}") {
        exclude module: "spring-boot-starter-undertow"
    }
    implementation "org.springframework.boot:spring-boot-starter-tomcat:${spring_boot_version}"
    implementation "org.springframework.boot:spring-boot-starter-websocket:${spring_boot_version}"
    implementation "org.springframework.boot:spring-boot-starter-thymeleaf:${spring_boot_version}"
    implementation "org.springframework.boot:spring-boot-starter-oauth2-resource-server:${spring_boot_version}"
    implementation "org.springframework.boot:spring-boot-starter-oauth2-client:${spring_boot_version}"

    implementation "org.springframework.ldap:spring-ldap-core:3.2.3"
    implementation "org.springframework.data:spring-data-ldap:3.2.5"

    implementation("org.springframework.cloud:spring-cloud-starter-netflix-eureka-client:4.1.1") {
        // NOTE: these modules contain security vulnerabilities and are not needed
        exclude module: "commons-jxpath"
        exclude module: "woodstox-core"
    }
    implementation "org.springframework.cloud:spring-cloud-starter-config:4.1.1"

    implementation "org.springframework.cloud:spring-cloud-commons:4.1.2"

    implementation "io.netty:netty-all:4.1.109.Final"
    implementation "io.projectreactor.netty:reactor-netty:1.1.18"
    implementation "org.springframework:spring-messaging:6.1.6"
    implementation "org.springframework.retry:spring-retry:2.0.5"

    implementation "org.springframework.security:spring-security-config:${spring_security_version}"
    implementation "org.springframework.security:spring-security-data:${spring_security_version}"
    implementation "org.springframework.security:spring-security-core:${spring_security_version}"
    implementation "org.springframework.security:spring-security-oauth2-core:${spring_security_version}"
    implementation "org.springframework.security:spring-security-oauth2-client:${spring_security_version}"
    // use newest version of nimbus-jose-jwt to avoid security issues through outdated dependencies
    implementation "com.nimbusds:nimbus-jose-jwt:9.37.3"
    implementation "org.springframework.security:spring-security-oauth2-jose:${spring_security_version}"
    implementation "org.springframework.security:spring-security-crypto:${spring_security_version}"
    implementation "org.springframework.security:spring-security-web:${spring_security_version}"
    implementation "org.springframework.security:spring-security-messaging:${spring_security_version}"
    implementation "org.springframework.security:spring-security-ldap:${spring_security_version}"
    implementation "org.springframework.security:spring-security-saml2-service-provider:${spring_security_version}"

    implementation "org.opensaml:opensaml-security-api:${opensaml_version}"
    implementation "org.opensaml:opensaml-core:${opensaml_version}"
    implementation "org.opensaml:opensaml-saml-impl:${opensaml_version}"
    implementation "org.opensaml:opensaml-saml-api:${opensaml_version}"

    implementation "org.xmlbeam:xmlprojector:1.4.24"
    implementation "io.jsonwebtoken:jjwt-api:${jwt_version}"
    runtimeOnly "io.jsonwebtoken:jjwt-impl:${jwt_version}"
    runtimeOnly "io.jsonwebtoken:jjwt-jackson:${jwt_version}"

    implementation "org.bouncycastle:bcpkix-jdk18on:1.78.1"
    implementation "org.bouncycastle:bcprov-jdk18on:1.78.1"

    implementation("io.springfox:springfox-swagger2:3.0.0") {
        exclude module: "mapstruct"
    }
    implementation "io.springfox:springfox-bean-validators:3.0.0"
    implementation "com.mysql:mysql-connector-j:8.3.0"
    implementation "org.postgresql:postgresql:42.7.3"
    implementation "com.h2database:h2:2.2.224"

    implementation "org.zalando:problem-spring-web:0.29.1"
    implementation "org.zalando:jackson-datatype-problem:0.27.1"
    implementation "com.ibm.icu:icu4j:75.1"
    implementation "com.github.seancfoley:ipaddress:5.5.0"
    implementation "org.apache.maven:maven-model:3.9.6"
    implementation "org.apache.pdfbox:pdfbox:3.0.2"
    implementation "com.google.protobuf:protobuf-java:4.26.1"
    implementation "org.apache.commons:commons-csv:1.10.0"
    implementation "org.commonmark:commonmark:0.22.0"
    implementation "commons-fileupload:commons-fileupload:1.5"
    implementation "net.lingala.zip4j:zip4j:2.11.5"
    implementation "org.jgrapht:jgrapht-core:1.5.2"
    // use newest version of guava to avoid security issues through outdated dependencies
    implementation "com.google.guava:guava:33.1.0-jre"

    // use newest version of gson to avoid security issues through outdated dependencies
    implementation "com.google.code.gson:gson:2.10.1"

    annotationProcessor "org.hibernate:hibernate-jpamodelgen:${hibernate_version}"
    annotationProcessor("org.glassfish.jaxb:jaxb-runtime:${jaxb_runtime_version}") {
        exclude group: "jakarta.ws.rs", module: "jsr311-api"
    }
    annotationProcessor("org.springframework.boot:spring-boot-configuration-processor:${spring_boot_version}") {
        exclude group: "com.vaadin.external.google", module: "android-json"
    }


    // ---- CHECKSTYLE DEPENDENCIES ----

    // use newest version of plexus to avoid security issues through outdated dependencies
    checkstyle "org.codehaus.plexus:plexus-container-default:2.1.1"
    checkstyle "org.codehaus.plexus:plexus-classworlds:2.8.0"
    checkstyle "com.puppycrawl.tools:checkstyle:${checkstyle_version}"


    // ---- TEST DEPENDENCIES ----

    testImplementation("org.springframework.boot:spring-boot-starter-test:${spring_boot_version}") {
        exclude group: "org.junit.vintage", module: "junit-vintage-engine"
        exclude group: "com.vaadin.external.google", module: "android-json"
    }
    testImplementation "org.springframework.security:spring-security-test:${spring_security_version}"
    testImplementation "org.springframework.boot:spring-boot-test:${spring_boot_version}"
    testImplementation "org.assertj:assertj-core:3.25.3"
    testImplementation "org.mockito:mockito-core:${mockito_version}"
    testImplementation "org.mockito:mockito-junit-jupiter:${mockito_version}"
    testImplementation "io.github.classgraph:classgraph:4.8.170"
    testImplementation "org.awaitility:awaitility:4.2.1"
    testImplementation "org.apache.maven.shared:maven-invoker:3.2.0"
    testImplementation "org.gradle:gradle-tooling-api:8.7"
    testImplementation "org.apache.maven.surefire:surefire-report-parser:3.2.5"
    testImplementation "com.opencsv:opencsv:5.9"
    testImplementation("io.zonky.test:embedded-database-spring-test:2.5.1") {
        exclude group: "org.testcontainers", module: "mariadb"
        exclude group: "org.testcontainers", module: "mssqlserver"
    }
    testImplementation "com.tngtech.archunit:archunit:1.3.0"
    testImplementation("org.skyscreamer:jsonassert:1.5.1") {
        exclude module: "android-json"
    }
    testImplementation("net.bytebuddy:byte-buddy") {
        version {
            strictly "1.14.13"
        }
    }
    testImplementation "io.github.classgraph:classgraph:4.8.172"

    // Lightweight JSON library needed for the internals of the MockRestServiceServer
    testImplementation "org.json:json:20240303"
}

ext["junit-jupiter.version"] = junit_version

dependencyManagement {
    imports {
        mavenBom "io.zonky.test.postgres:embedded-postgres-binaries-bom:16.1.0"
    }
}

tasks.register("cleanResources", Delete) {
    delete "build/resources"
}

// Taken from here: https://stackoverflow.com/questions/3963708/gradle-how-to-display-test-results-in-the-console-in-real-time
tasks.withType(Test).configureEach {
    testLogging {
        // set options for log level LIFECYCLE
        events TestLogEvent.FAILED,
                TestLogEvent.PASSED,
                TestLogEvent.SKIPPED
        exceptionFormat TestExceptionFormat.FULL
        showExceptions true
        showCauses true
        showStackTraces true

        info.events = debug.events
        info.exceptionFormat = debug.exceptionFormat
    }

    afterSuite { desc, result ->
        if (!desc.parent) { // will match the outermost suite
            def output = "Results: ${result.resultType} (${result.testCount} tests, ${result.successfulTestCount} successes, ${result.failedTestCount} failures, ${result.skippedTestCount} skipped)"
            def startItem = "|  ", endItem = "  |"
            def repeatLength = startItem.length() + output.length() + endItem.length()
            println("\n" + ("-" * repeatLength) + "\n" + startItem + output + endItem + "\n" + ("-" * repeatLength))
        }
    }
}

wrapper {
    gradleVersion = "8.7"
}

tasks.register("stage") {
    dependsOn "bootWar"
}

node {
    download = true
    version = "${node_version}"
    npmVersion = "${npm_version}"
}

// Set the npm cache (used in the Dockerfile)
tasks.register("npmSetCacheDockerfile", NpmTask) {
    args = ["set", "cache", "/opt/artemis/.npm"]
}

// Command to execute the JavaDoc checkstyle verification ./gradlew checkstyleMain
checkstyle {
    toolVersion "${checkstyle_version}"
    configFile file("checkstyle.xml")
    checkstyleTest.enabled = false
    maxErrors = 0
}

def isNonStable = { String version ->
    def stableKeyword = ["RELEASE", "FINAL", "GA"].any { it -> version.toUpperCase().contains(it) }
    def regex = /^[0-9,.v-]+(-r)?$/
    return !stableKeyword && !(version ==~ regex)
}

tasks.named("dependencyUpdates").configure {
    rejectVersionIf {
        isNonStable(it.candidate.version)
    }

    rejectVersionIf {
        isNonStable(it.candidate.version) && !isNonStable(it.currentVersion)
    }
}

// Available commands:
//
// 1) Build production:                             ./gradlew -Pprod -Pwar clean bootWar
// 2) Execute tests with coverage report:           ./gradlew test jacocoTestReport -x webapp
// 2a) Execute tests without coverage report:       ./gradlew test -x webapp
// 2b) Run a single test:                           ./gradlew test --tests ExamIntegrationTest -x webapp or ./gradlew test --tests ExamIntegrationTest.testGetExamScore -x webapp
// 2c) Execute tests with Postgres container:       SPRING_PROFILES_INCLUDE=postgres ./gradlew test -x webapp
// 2d) Execute tests with MySQL container:          SPRING_PROFILES_INCLUDE=mysql ./gradlew test -x webapp
// 3) Verify code coverage (after tests):           ./gradlew jacocoTestCoverageVerification
// 4) Check Java code format:                       ./gradlew spotlessCheck -x webapp
// 5) Apply Java code formatter:                    ./gradlew spotlessApply -x webapp
// 6) Find dependency updates:                      ./gradlew dependencyUpdates -Drevision=release
// 7) Check JavaDoc:                                ./gradlew checkstyleMain -x webapp
// 8) Detects uses of legacy code:                  ./gradlew modernizer -x webapp
// 9) Check for vulnerabilities in dependencies     ./gradlew dependencyCheckAnalyze -x webapp
// 10) Clear Liquibase checksums:                   ./gradlew liquibaseClearChecksums
// 11) Create changelog between Java and DB         ./gradlew liquibaseDiffChangeLog (make sure to set the correct username and password in liquibase.gradle)
// 12) Generate initial schema from DB              ./gradlew liquibaseGenerateChangelog (make sure to set the correct username and password in liquibase.gradle)