build.gradle

// Security: the jreleaser plugin pulls in vulnerable jackson-core/jackson-databind 2.22.x
// and Apache HttpComponents 5 versions. Remove once the plugin ships patched versions.
buildscript {
    dependencies {
        classpath(platform("com.fasterxml.jackson:jackson-bom:2.22.4"))
        constraints {
            classpath("org.apache.httpcomponents.client5:httpclient5:5.6.5") {
                because 'Security issues'
            }
            classpath("org.apache.httpcomponents.core5:httpcore5:5.4.4") {
                because 'Security issues'
            }
            classpath("org.apache.httpcomponents.core5:httpcore5-h2:5.4.4") {
                because 'Security issues'
            }
        }
    }
}

plugins {
    id 'io.github.ben-manes.versions' version '0.65.0' apply false // ./gradlew dependencyUpdates
    id "org.sonarqube" version "7.5.0.8588"
    id 'org.jreleaser' version '1.26.0' apply false
}

// Security: the Spring Boot Gradle plugin (declared locally in examples/*) pulls in
// vulnerable tools.jackson 3.1.x versions. Remove once springBootVersion ships patched versions.
subprojects {
    buildscript {
        dependencies {
            constraints {
                classpath("tools.jackson.core:jackson-core:3.2.4") {
                    because 'Security issues'
                }
                classpath("tools.jackson.core:jackson-databind:3.2.4") {
                    because 'Security issues'
                }
            }
        }
    }
}

// Define version variables at root level so they're available everywhere
ext {
    springBootVersion = '4.1.2' // https://repo1.maven.org/maven2/org/springframework/boot/spring-boot-dependencies/
    // The following versions are managed by Spring Boot BOM (no need to define here):
    // junitJupiterVersion, mockitoVersion, slf4jVersion, logbackVersion, 
    // jacksonVersion, jacksonDatabindVersion, micrometerVersion, janinoVersion,
    // servletVersion (jakarta-servlet), annotationApiVersion (jakarta-annotation),
    // nettyVersion, jsonPathVersion

    // Versions NOT in Spring Boot BOM - we manage these ourselves:
    googleTruthVersion = '1.4.5'
    logbackLogstashVersion = '9.0'
    logbookVersion = '4.2.0'
    jacksonSyntaxHighlightVersion = '2.0.4'
    logbackLogstashSyntaxHighlightingDecoratorsVersion = '2.0.3'
    commonsIoVersion = '2.22.0'
    commonsTextVersion = '1.15.0'
    nettyTcnativeBoringsslStaticVersion = '2.0.84.Final'

    grpcNettyVersion = '1.85.1'
    grpcVersion = '1.85.1'
    grpcCommonsVersion = '2.78.0'
    grpcProtobufVersion = '4.36.2'

    jsonAssertVersion = '0.8.0'

    // Security: override the Jackson versions from the Spring Boot BOM.
    // Remove once springBootVersion manages these (or newer) versions.
    jacksonBomVersion = '3.2.4'
}

// Split projects into buildable: examples and libraries. 
// This omits 'wrapper' directories. See also settings.gradle

def buildProjects() {
    subprojects.findAll { new File(it.projectDir, 'build.gradle').file }
}

def platformProjects() {
    buildProjects().findAll { it.name.equals("bom") }
}

def exampleProjects() {
    buildProjects().findAll { it.name.endsWith("-example") }
}

def libraryProjects() {
    buildProjects().findAll { !exampleProjects().contains(it) && !platformProjects().contains(it) }
}

def jvmProjects() {
    buildProjects().findAll { !platformProjects().contains(it) }
}

configure(exampleProjects()) {
    apply plugin: 'java'

    java {
        toolchain {
            languageVersion = JavaLanguageVersion.of(25) // Specify desired Java version (e.g., Java 17)
        }
    }

    dependencies {
        // Use Spring Boot BOM for dependency management
        implementation platform("org.springframework.boot:spring-boot-dependencies:${springBootVersion}")
        implementation platform("tools.jackson:jackson-bom:${jacksonBomVersion}")
    }
}

configure(libraryProjects()) {
    apply plugin: 'java-library'

    java {
        toolchain {
            languageVersion = JavaLanguageVersion.of(17) // Specify desired Java version (e.g., Java 17)
        }
    }

    dependencies {
        // Use api(platform(...)) to enforce Spring Boot BOM versions for all dependency configurations
        // This ensures both api and implementation dependencies get pinned versions
        api(platform("org.springframework.boot:spring-boot-dependencies:${springBootVersion}"))
        api(platform("tools.jackson:jackson-bom:${jacksonBomVersion}"))
    }
}

configure(jvmProjects()) {
    apply plugin: 'io.github.ben-manes.versions'

    test {
        useJUnitPlatform {
            includeEngines 'junit-jupiter'
        }
    }

    dependencies {
        components.all(LogbackAlignmentRule)
        components.all(GrpcAlignmentRule)
        components.all(ProtobufAlignmentRule)
        components.all(JunitAlignmentRule)

        // JUnit Jupiter API and TestEngine implementation - versions managed by BOM
        testImplementation("org.junit.jupiter:junit-jupiter")

        // https://stackoverflow.com/questions/79640685/cannot-build-project-after-upgrading-spring-boot-to-3-5
        testRuntimeOnly "org.junit.platform:junit-platform-launcher"
        testImplementation("org.mockito:mockito-core")

        testImplementation("com.google.truth:truth:${googleTruthVersion}")
        testImplementation("com.google.truth.extensions:truth-java8-extension:${googleTruthVersion}")
    }

    // from https://github.com/ben-manes/gradle-versions-plugin?tab=readme-ov-file#rejectversionsif-and-componentselection
    def isNonStable = { String version ->
        def stableKeyword = ['RELEASE', 'FINAL', 'GA'].any { ita -> version.toUpperCase().contains(ita) }
        def regex = /^[0-9,.v-]+(-r)?$/
        return !stableKeyword && !(version ==~ regex)
    }

    tasks.named("dependencyUpdates").configure {
        rejectVersionIf {
            isNonStable(it.candidate.version)
        }
    }

    configurations.all {
        resolutionStrategy.eachDependency { DependencyResolveDetails details ->
            if (details.requested.group == 'org.apache.tomcat.embed') {
                if (isLowerThanMin(details.requested.version, "11.0.25")) {
                    details.useVersion '11.0.25'
                    details.because 'Security issues'
                }
            }
        }
    }
}

ext.stagingRepositoryPath = "${rootDir.getCanonicalFile()}/build/staging-deploy"
System.out.println("Staging repository is " + ext.stagingRepositoryPath)

// projects which should be published
configure(libraryProjects()) {
    apply plugin: 'maven-publish'

    java {
        withSourcesJar()
        withJavadocJar()
    }

    publishing {

        publications {
            maven(MavenPublication) {
                from components.java

                groupId = "$group"
                artifactId = project.name

                if(project.ext.has('artifactId')) {
                    System.out.println("Publishing " + project.name + " with artifact-id " + project.ext.artifactId)
                }

                pom {
                    name = "${!project.ext.has('artifactId') ? project.name : project.ext.artifactId}"
                    url = 'https://github.com/entur/cloud-logging'
                    packaging = 'jar'
                    inceptionYear = '2023'
                    description = project.name

                    licenses {
                        license {
                            name = 'European Union Public Licence v1.2'
                            url = 'https://www.eupl.eu/'
                            distribution = 'repo'
                        }
                    }
                    developers {
                        developer {
                            id = "skjolber"
                            name = "Thomas Skjølberg"
                            email = "thomas.rorvik.skjolberg@entur.org"
                        }
                    }
                    scm {
                        url = 'https://github.com/entur/cloud-logging'
                        connection = 'git@github.com:entur/cloud-logging.git'
                    }
                    
                    // Resolve and add versions from platform to all dependencies
                    withXml {
                        // Remove the dependencyManagement section since we're adding explicit versions
                        def dependencyManagement = asNode().dependencyManagement
                        if (dependencyManagement) {
                            asNode().remove(dependencyManagement[0])
                        }
                        
                        // Add explicit versions to all dependencies
                        def dependenciesNode = asNode().dependencies[0]
                        if (dependenciesNode) {
                            dependenciesNode.dependency.each { dep ->
                                if (!dep.version) {
                                    def group = dep.groupId.text()
                                    def artifact = dep.artifactId.text()
                                    def resolvedVersion = project.configurations.runtimeClasspath.resolvedConfiguration
                                        .resolvedArtifacts.find { it.moduleVersion.id.group == group && it.moduleVersion.id.name == artifact }
                                        ?.moduleVersion?.id?.version
                                    if (resolvedVersion) {
                                        dep.appendNode('version', resolvedVersion)
                                    }
                                }
                            }
                        }
                    }
                }
            }
        }

        repositories {
            maven {
                url = stagingRepositoryPath
            }
        }
    }

    // must be after evaluate to actually take effect
    // check using command: ./gradlew publishToMavenLocal --info | grep MetadataFileForMaven
    // not that tasks are SKIPPED
    afterEvaluate {
        tasks.withType(GenerateModuleMetadata) {
            enabled = false
        }
    }
}

allprojects {
    apply plugin: 'eclipse'
    apply plugin: 'idea'

    eclipse {
        classpath {
            downloadSources = true
            downloadJavadoc = true
        }
    }

    idea {
        module {
            downloadJavadoc = true
            downloadSources = true
        }
    }
    
    repositories {
        mavenLocal()
        mavenCentral()
    }

}

abstract class LogbackAlignmentRule implements ComponentMetadataRule {
    void execute(ComponentMetadataContext ctx) {
        ctx.details.with {
            if (id.group.startsWith("ch.qos.logback")) {
                belongsTo("ch.qos.logback:logback-virtual-platform:${id.version}")
            }
        }
    }
}

abstract class GrpcAlignmentRule implements ComponentMetadataRule {
    void execute(ComponentMetadataContext ctx) {
        ctx.details.with {
            if (id.group.startsWith("io.grpc")) {
                belongsTo("io.grpc:grpc-virtual-platform:${id.version}")
            }
        }
    }
}
abstract class ProtobufAlignmentRule implements ComponentMetadataRule {
    void execute(ComponentMetadataContext ctx) {
        ctx.details.with {
            if (id.group.startsWith("com.google.protobuf")) {
                belongsTo("com.google.protobuf:protobuf-virtual-platform:${id.version}")
            }
        }
    }
}

abstract class JunitAlignmentRule implements ComponentMetadataRule {
    void execute(ComponentMetadataContext ctx) {
        ctx.details.with {
            if (id.group.startsWith("org.junit.jupiter ")) {
                belongsTo("org.junit.jupiter:junit-virtual-platform:${id.version}")
            }
        }
    }
}



task clean {
    //project.delete(files(getBuildDir()) {
    //})
}

apply plugin: 'org.jreleaser'

jreleaser {
    signing {
        active = 'ALWAYS'
        armored = true
    }
    deploy {
        maven {
            mavenCentral {
                release {
                    active = 'RELEASE'
                    url = 'https://central.sonatype.com/api/v1/publisher'
                    stagingRepository(stagingRepositoryPath)
                }
            }
            nexus2 {
                snapshot {
                    active = 'SNAPSHOT'
                    applyMavenCentralRules = true
                    snapshotSupported = true
                    closeRepository = true
                    releaseRepository = true
                    url = "https://ossrh-staging-api.central.sonatype.com/service/local"
                    snapshotUrl = 'https://central.sonatype.com/repository/maven-snapshots/'
                    stagingRepository(stagingRepositoryPath)
                }
            }
        }
    }
    release {
        github {
            skipTag = false // Skip creating a new github tag?
            skipRelease = true // Skip creating a new github release?
            tagName = "v${version}"
        }
    }
}

boolean isLowerThanMin(String currentVersion, String minVersion) {
    if (currentVersion == null || minVersion == null) return false
    return new org.apache.maven.artifact.versioning.ComparableVersion(currentVersion) < new org.apache.maven.artifact.versioning.ComparableVersion(minVersion)
}