38 audit generic fixes (#40)

GitHub Actions

.github/workflows/mega-linter.yml

@@ -0,0 +1,55 @@
+# MegaLinter GitHub Action configuration file
+# More info at https://megalinter.github.io
+name: MegaLinter
+
+on:
+  # Trigger mega-linter at every push. Action will also be visible from Pull Requests to main
+  push: # Comment this line to trigger action only on pull-requests (not recommended if you don't pay for GH Actions)
+
+env: # Comment env block if you do not want to apply fixes
+  # Apply linter fixes configuration
+  APPLY_FIXES: all # When active, APPLY_FIXES must also be defined as environment variable (in github/workflows/mega-linter.yml or other CI tool)
+  #APPLY_FIXES_EVENT: pull_request # Decide which event triggers application of fixes in a commit or a PR (pull_request, push, all)
+  #APPLY_FIXES_MODE: pull_request # If APPLY_FIXES is used, defines if the fixes are directly committed (commit) or posted in a PR (pull_request)
+  DISABLE_LINTERS: SPELL_CSPELL,COPYPASTE_JSCPD
+  FILTER_REGEX_EXCLUDE: .*/.*gradle
+
+concurrency:
+  group: ${{ github.ref }}-${{ github.workflow }}
+  cancel-in-progress: true
+
+jobs:
+  build:
+    name: MegaLinter
+    runs-on: ubuntu-latest
+    steps:
+      # Git Checkout
+      - name: Checkout Code
+        uses: actions/checkout@v3
+        with:
+          token: ${{ secrets.PAT || secrets.GITHUB_TOKEN }}
+          fetch-depth: 0 # If you use VALIDATE_ALL_CODEBASE = true, you can remove this line to improve performances
+
+      # MegaLinter
+      - name: MegaLinter
+        id: ml
+        # You can override MegaLinter flavor used to have faster performances
+        # More info at https://megalinter.github.io/flavors/
+        uses: oxsecurity/megalinter/flavors/[email protected]
+        env:
+          # All available variables are described in documentation
+          # https://megalinter.github.io/configuration/
+          VALIDATE_ALL_CODEBASE: ${{ github.event_name == 'push' && github.ref == 'refs/heads/main' }} # Validates all source when push on main, else just the git diff with main. Override with true if you always want to lint all sources
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          # ADD YOUR CUSTOM ENV VARIABLES HERE OR DEFINE THEM IN A FILE .mega-linter.yml AT THE ROOT OF YOUR REPOSITORY
+          DISABLE: COPYPASTE,SPELL # Uncomment to disable copy-paste and spell checks
+
+      # Upload MegaLinter artifacts
+      - name: Archive production artifacts
+        if: ${{ success() }} || ${{ failure() }}
+        uses: actions/upload-artifact@v3
+        with:
+          name: MegaLinter reports
+          path: |
+            megalinter-reports
+            mega-linter.log

.github/workflows/test.yml

@@ -0,0 +1,31 @@
+name: Test
+
+on:
+  # Trigger at every push. Action will also be visible from Pull Requests to master
+  push: # Comment this line to trigger action only on pull-requests (not recommended if you don't pay for GH Actions)
+  pull_request:
+    branches: [master]
+
+jobs:
+  build:
+    name: Test
+    runs-on: ubuntu-latest
+    steps:
+    # Git Checkout
+    - name: Checkout Code
+      uses: actions/checkout@v3
+      with:
+        token: ${{ secrets.PAT || secrets.GITHUB_TOKEN }}
+        fetch-depth: 0
+
+    - name: Setup Java
+      uses: actions/setup-java@v3
+      with:
+        distribution: temurin
+        java-version: 17
+
+    - name: Setup Gradle
+      uses: gradle/gradle-build-action@v2
+
+    - name: Run Gradle Tests
+      run: make test

.groovylintrc.json

@@ -0,0 +1,83 @@
+{
+    "extends": "recommended",
+    "rules": {
+        "MethodCount": {
+            "enabled": false
+        },
+        "JavadocMissingParamDescription": {
+            "enabled": false
+        },
+        "JavadocMissingThrowsDescription": {
+            "enabled": false
+        },
+        "JavadocEmptyReturnTag": {
+            "enabled": false
+        },
+        "JavadocEmptyFirstLine": {
+            "enabled": false
+        },
+        "JUnitPublicNonTestMethod": {
+            "enabled": false
+        },
+        "CatchException": {
+            "enabled": false
+        },
+        "CatchThrowable": {
+            "enabled": false
+        },
+        "ClassJavadoc": {
+            "enabled": false
+        },
+        "ClosureAsLastMethodParameter": {
+            "enabled": false
+        },
+        "DuplicateNumberLiteral": {
+            "enabled": false
+        },
+        "DuplicateStringLiteral": {
+            "enabled": false
+        },
+        "FieldTypeRequired": {
+            "enabled": false
+        },
+        "JavaIoPackageAccess": {
+            "enabled": false
+        },
+        "MethodParameterTypeRequired": {
+            "enabled": false
+        },
+        "MethodSize": {
+            "enabled": false
+        },
+        "NoDef": {
+            "enabled": false
+        },
+        "PrintStackTrace": {
+            "enabled": false
+        },
+        "PropertyName": {
+            "enabled": false
+        },
+        "SpaceAroundMapEntryColon": {
+            "enabled": false
+        },
+        "SystemExit": {
+            "enabled": false
+        },
+        "UnnecessaryGetter": {
+            "enabled": false
+        },
+        "UnnecessaryObjectReferences": {
+            "enabled": false
+        },
+        "UnnecessarySetter": {
+            "enabled": false
+        },
+        "VariableName": {
+            "enabled": false
+        },
+        "VariableTypeRequired": {
+            "enabled": false
+        }
+    }
+}

Makefile

@@ -16,7 +16,13 @@ compile:
 	@echo "DONE `date`"
 
 check:
-	./gradlew check
+	./gradlew check --warning-mode all
+
+coverage: compile
+	./gradlew cloverInstrumentCodeForTest
+
+.PHONY: clean test all
+test: clean compile check #coverage
 
 
 #

README.md

@@ -23,7 +23,7 @@ which quilt3 # e.g., /usr/local/bin/quilt3
 
 ### Loading the nf-quilt plugin
 
-Once this plugin is officially published on `nextflow-io/plugins`, 
+Once this plugin is officially published on `nextflow-io/plugins`,
 you can enable it by modifying `nextflow.config`.
 Add the following snippet, or just add that one 'id' if you already have other plugins):
 ```groovy
@@ -43,36 +43,36 @@ Next, create a Quilt URL for the S3 bucket where you want to store (and eventual
 You must specify a package name containing exactly one '/', such as `instrument/experiment`
 e.g. "quilt+s3://raw-bucket#package=nf-quilt/sarek"
 
-Note your command-line environment must have 
-[AWS credentials](https://docs.aws.amazon.com/cli/latest/userguide/cli-configure-files.html) 
+Note your command-line environment must have
+[AWS credentials](https://docs.aws.amazon.com/cli/latest/userguide/cli-configure-files.html)
 that allow you to read/write that bucket.
 
 Finally, run your Nextflow pipeline as usual, setting that URL as your output directory, .e.g.:
 
-```
+```bash
 ./launch.sh run nf-core/sarek -profile test,docker --outdir quilt+s3://raw-bucket#package=nf-quilt/sarek&path=.
 ```
 
 You can also use Quilt packages as input to nextflow jobs, e.g.:
 
-```
+```bash
 nextflow run my/analysis --indir quilt+s3://raw-bucket#package=experiment/instrument --outdir quilt+s3://prod-bucket#package=experiment/analysis
 ```
 
 
-# Development
+## Development
 
 _Based on [nf-hello](https://github.com/nextflow-io/nf-hello)_
 
-## Unit testing
+### Unit testing
 
 Run the following command in the project root directory (ie. where the file `settings.gradle` is located):
 
 ```bash
 make check
 ```
 
-## Testing and debugging
+### Testing and debugging
 
 1. Clone the Nextflow repository into a sibling directory, .e.g:
 
@@ -99,7 +99,7 @@ make pkg-test BUCKET=my-s3-bucket # default, simply copies a package
 make sarek BUCKET=my-s3-bucket # runs nf-core/sarek, or any other pipeline that uses `--outdir`
 ```
 
-## Package, upload and publish
+### Package, upload and publish
 
 The project should be hosted in a GitHub repository whose name should match the name of the plugin, that is the name of the directory in the `plugins` folder (e.g. `nf-quilt`).
 
@@ -113,14 +113,15 @@ Follow these steps to package, upload and publish the plugin:
    * `github_commit_email`: The email address associated with your GitHub account.
 
 3. Use the following command to package and create a release for your plugin on GitHub:
-   ```bash
-   ./gradlew :plugins:nf-quilt:upload
-   ```
+```bash
+./gradlew :plugins:nf-quilt:upload
+```
 
 4. Fork the [nextflow-io/plugins](https://github.com/nextflow-io/plugins) repository to one you can write to
 
 5. Use the following command to publish your plugin to your fork:
-    ```bash
-    ./gradlew :plugins:publishIndex
-    ```
+ ```bash
+ ./gradlew :plugins:publishIndex
+ ```
+
 6. Create a pull request to push your changes back to [nextflow-io/plugins](https://github.com/nextflow-io/plugins/blob/main/plugins.json)

build.gradle

@@ -16,7 +16,7 @@
  */
 
 plugins {
-    id "io.codearte.nexus-staging" version "0.30.0"
+    id 'io.codearte.nexus-staging' version '0.30.0'
     id 'java'
     id 'idea'
 }
@@ -34,10 +34,12 @@ if (groovyVer) {
         configurations.all {
             resolutionStrategy.eachDependency { DependencyResolveDetails details ->
                 if (details.requested.group == 'org.codehaus.groovy') {
-                    if( groovyVer.contains(':') )
+                    if (groovyVer.contains(':')) {
                         details.useTarget(groovyVer)
-                    else
+                    }
+                    else {
                         details.useVersion(groovyVer)
+                    }
                     println ">> Overriding $details.requested with version: $groovyVer"
                 }
             }
@@ -46,7 +48,7 @@ if (groovyVer) {
 }
 
 def projects(String...args) {
-    args.collect {project(it)}
+    args.collect { project(it) }
 }
 
 group = 'io.nextflow'
@@ -94,15 +96,17 @@ allprojects {
 
     dependencies {
         // see https://docs.gradle.org/4.1/userguide/dependency_management.html#sec:module_replacement
+        implementation 'org.codehaus.groovy:groovy-all:3.0.14'
         implementation group: 'com.fasterxml.jackson.core', name: 'jackson-databind', version: '2.14.1'
+
         modules {
-            module("commons-logging:commons-logging") { replacedBy("org.slf4j:jcl-over-slf4j") }
+            module('commons-logging:commons-logging') { replacedBy('org.slf4j:jcl-over-slf4j') }
         }
 
         // Documentation required libraries
         groovyDoc 'org.fusesource.jansi:jansi:2.4.0'
-        groovyDoc "org.codehaus.groovy:groovy-groovydoc:3.0.14"
-        groovyDoc "org.codehaus.groovy:groovy-ant:3.0.14"
+        groovyDoc 'org.codehaus.groovy:groovy-groovydoc:3.0.14'
+        groovyDoc 'org.codehaus.groovy:groovy-ant:3.0.14'
     }
 
     test {
@@ -133,13 +137,13 @@ allprojects {
     // http://forums.gradle.org/gradle/topics/gradle_task_groovydoc_failing_with_noclassdeffounderror
     tasks.withType(Groovydoc) {
         groovyClasspath = project.configurations.groovyDoc
-        includes = ["nextflow/**"]
+        includes = ['nextflow/**']
     }
 
     // Required to run tests on Java 9 and higher in compatibility mode
     if (JavaVersion.current() >= JavaVersion.VERSION_1_9) {
         tasks.withType(Test) {
-            jvmArgs ([
+            jvmArgs([
                     '--add-opens=java.base/java.lang=ALL-UNNAMED',
                     '--add-opens=java.base/java.io=ALL-UNNAMED',
                     '--add-opens=java.base/java.nio=ALL-UNNAMED',
@@ -162,19 +166,21 @@ allprojects {
 
 def getRuntimeConfigs() {
     def names = subprojects
-            .findAll { prj -> prj.name in ['nextflow','nf-commons','nf-httpfs'] }
-            .collect { it.name }
+            .findAll { prj -> prj.name in ['nextflow', 'nf-commons', 'nf-httpfs'] }
+            .collect { p -> p.name }
 
     FileCollection result = null
-    for( def it : names ) {
+    for ( def it : names ) {
         def cfg = project(it).configurations.getByName('runtimeClasspath')
-        if( result==null )
+        if ( result == null ) {
             result = cfg
-        else
+        }
+        else {
             result += cfg
-        // this include the module actual jar file
-        // note: migrating to gradle 7 does not work any more
-        //result = result + cfg.getOutgoing().getArtifacts().getFiles()
+        }
+    // this include the module actual jar file
+    // note: migrating to gradle 7 does not work any more
+    //result = result + cfg.getOutgoing().getArtifacts().getFiles()
     }
     return result
 }
@@ -188,9 +194,7 @@ task exportClasspath {
         def home = System.getProperty('user.home')
         def all = getRuntimeConfigs()
         def libs = all.collect { File file ->  /*println file.canonicalPath.replace(home, '$HOME');*/ file.canonicalPath;  }
-        ['nextflow','nf-commons','nf-httfs'].each {libs << file("modules/$it/build/libs/${it}-${version}.jar").canonicalPath }
+        ['nextflow', 'nf-commons', 'nf-httfs'].each { libs << file("modules/$it/build/libs/${it}-${version}.jar").canonicalPath }
         file('.launch.classpath').text = libs.unique().join(':')
     }
 }
-
-

gradlew

@@ -91,11 +91,11 @@ DEFAULT_JVM_OPTS='"-Xmx64m" "-Xms64m"'
 # Use the maximum available, or set MAX_FD != -1 to use that value.
 MAX_FD=maximum
 
-warn () {
+warn() {
     echo "$*"
 } >&2
 
-die () {
+die() {
     echo
     echo "$*"
     echo