build.gradle

import org.flywaydb.gradle.task.FlywayMigrateTask

//This is required as flyway now has a stand alone library for each database rather than being bundled together
buildscript {
  dependencies {
    classpath("org.flywaydb:flyway-database-postgresql:12.5.0")
  }
}

plugins {
  id 'application'
  id 'jacoco'
  id 'io.spring.dependency-management' version '1.1.7'
  id 'org.springframework.boot' version '3.5.14'
  id 'com.github.ben-manes.versions' version '0.54.0'
  id 'org.sonarqube' version '7.2.3.7755'
  id 'uk.gov.hmcts.java' version '0.12.68'
  id 'io.freefair.lombok' version '9.5.0'
  id 'org.flywaydb.flyway' version '12.5.0'
  id 'io.qameta.allure' version '3.2.0'
}

application {
  mainClass = 'uk.gov.hmcts.reform.fact.data.api.Application'
  group = 'uk.gov.hmcts.reform'
  version = '0.0.1'
}

java {
  toolchain {
    languageVersion = JavaLanguageVersion.of(21)
  }
}

def configureSourceSet(String name) {
  sourceSets.create(name) { sourceSet ->
    sourceSet.java {
      compileClasspath += sourceSets.main.output + sourceSets.test.output
      runtimeClasspath += sourceSets.main.output + sourceSets.test.output
      srcDir "src/${name}/java"
    }
    sourceSet.resources.srcDir "src/${name}/resources"
  }
}

['smokeTest', 'integrationTest', 'functionalTest'].each { configureSourceSet(it) }

configurations {
  smokeTestImplementation.extendsFrom testImplementation
  smokeTestRuntimeOnly.extendsFrom runtimeOnly

  functionalTestImplementation.extendsFrom smokeTestImplementation
  functionalTestRuntimeOnly.extendsFrom runtimeOnly

  integrationTestImplementation.extendsFrom testImplementation
  integrationTestRuntimeOnly.extendsFrom runtimeOnly
}

flyway {
  url = System.getenv('FLYWAY_URL')
  user = System.getenv('FLYWAY_USER')
  password = System.getenv('FLYWAY_PASSWORD')
  baselineOnMigrate = true
  baselineVersion = '000'
}

tasks.register('migratePostgresDatabase', FlywayMigrateTask) {
  baselineOnMigrate = true
  if (project.hasProperty("dburl")) {
    url = "jdbc:postgresql://${dburl}"
  }
}

tasks.withType(JavaCompile).configureEach {
  options.compilerArgs << "-Xlint:unchecked" << "-Werror"
}

// https://github.com/gradle/gradle/issues/16791
tasks.withType(JavaExec).configureEach {
  javaLauncher.set(javaToolchains.launcherFor(java.toolchain))
}

tasks.withType(Test).configureEach {
  useJUnitPlatform()
  failFast = true

  testLogging {
    exceptionFormat = 'full'
  }
}

tasks.register('functional', Test) {
  description = "Runs functional tests"
  group = "Verification"
  testClassesDirs = sourceSets.functionalTest.output.classesDirs
  classpath = sourceSets.functionalTest.runtimeClasspath
}

tasks.register('integration', Test) {
  description = "Runs integration tests"
  group = "Verification"
  testClassesDirs = sourceSets.integrationTest.output.classesDirs
  classpath = sourceSets.integrationTest.runtimeClasspath
  failFast = true
}

tasks.register('smoke', Test) {
  description = "Runs Smoke Tests"
  group = "Verification"
  testClassesDirs = sourceSets.smokeTest.output.classesDirs
  classpath = sourceSets.smokeTest.runtimeClasspath
}

jacocoTestReport {
  executionData(test, integration)
  reports {
    xml.required.set(true)
    csv.required.set(false)
    xml.outputLocation.set(layout.buildDirectory.file("reports/jacoco/test/jacocoTestReport.xml"))
  }
}

project.tasks['sonarqube'].dependsOn jacocoTestReport

sonarqube {
  properties {
    property "sonar.projectName", "fact-data-api"
    property "sonar.projectKey", "uk.gov.hmcts.reform:fact-data-api"
    // entities are atomic in the repo and necessarily have some duplication that
    // we need to ignore.
    property "sonar.cpd.exclusions", "**/entities/*.java"
    // we use entities as DTOs for our controllers
    property "sonar.issue.ignore.multicriteria", "e1"
    property "sonar.issue.ignore.multicriteria.e1.ruleKey", "java:S4684"
    property "sonar.issue.ignore.multicriteria.e1.resourceKey", "uk/gov/hmcts/reform/fact/data/api/controllers/*.java"
  }
}

// before committing a change, make sure task still works
dependencyUpdates {
  def isNonStable = { String version ->
    def stableKeyword = ['RELEASE', 'FINAL', 'GA'].any { qualifier -> version.toUpperCase().contains(qualifier) }
    def regex = /^[0-9,.v-]+$/
    return !stableKeyword && !(version ==~ regex)
  }
  rejectVersionIf { selection -> // <---- notice how the closure argument is named
    return isNonStable(selection.candidate.version) && !isNonStable(selection.currentVersion)
  }
}

// https://jeremylong.github.io/DependencyCheck/dependency-check-gradle/configuration.html
dependencyCheck {
  suppressionFile = 'config/owasp/suppressions.xml'
}

allure {
  version = '2.34.1'
}

repositories {
  mavenLocal()
  mavenCentral()
  maven {
    url = uri('https://pkgs.dev.azure.com/hmcts/Artifacts/_packaging/hmcts-lib/maven/v1')
  }
}

ext {
  log4JVersion = "2.25.3"
  logbackVersion = "1.5.19"
}

ext['snakeyaml.version'] = '2.0'
ext['log4j2.version'] = '2.25.3' // CVE-2025-68161

dependencies {
  implementation group: 'org.springframework.boot', name: 'spring-boot-starter-web'
  implementation group: 'org.springframework.boot', name: 'spring-boot-starter-actuator'
  implementation group: 'org.springframework.boot', name: 'spring-boot-starter-data-jpa'
  implementation group: 'org.springframework.boot', name: 'spring-boot-starter-aop'
  implementation group: 'org.springframework.cloud', name: 'spring-cloud-starter-openfeign', version: '4.3.2'
  // auth
  implementation group: 'org.springframework.boot', name: 'spring-boot-starter-security'
  implementation group: 'org.springframework.boot', name: 'spring-boot-starter-oauth2-client'
  implementation group: 'org.springframework.boot', name: 'spring-boot-starter-oauth2-resource-server'
  implementation group: 'com.azure.spring', name: 'spring-cloud-azure-starter', version: '6.3.0'
  implementation group: 'org.springframework.cloud', name: 'spring-cloud-starter-openfeign', version: '4.3.2'

  implementation group: 'org.springdoc', name: 'springdoc-openapi-starter-webmvc-ui', version: '2.8.17'

  implementation group: 'org.postgresql', name: 'postgresql', version: '42.7.11'

  implementation group: 'org.flywaydb', name: 'flyway-core', version: '12.5.0'
  implementation group: 'org.flywaydb', name: 'flyway-database-postgresql', version: '12.5.0'

  implementation group: 'com.azure.spring', name: 'spring-cloud-azure-starter-storage-blob', version: '6.3.0'

  implementation group: 'io.hypersistence', name: 'hypersistence-utils-hibernate-63', version: '3.15.2'

  implementation group: 'com.fasterxml.jackson.datatype', name: 'jackson-datatype-hibernate6', version: '2.21.3'

  implementation group: 'com.github.hmcts.java-logging', name: 'logging', version: '8.0.0'

  implementation group: 'org.apache.commons', name: 'commons-lang3', version: '3.20.0'

  implementation group: 'com.slack.api', name: 'slack-api-client', version: '1.48.1'

  //Solves CVE-2025-48976
  implementation group: 'commons-fileupload', name: 'commons-fileupload', version: '1.6.0'

  testImplementation group: 'org.springframework.boot', name: 'spring-boot-starter-test'

  integrationTestImplementation group: 'org.testcontainers', name: 'postgresql', version: '1.21.4'

  smokeTestImplementation group: 'io.rest-assured', name: 'rest-assured', version: '5.5.7'
  functionalTestImplementation group: 'com.fasterxml.jackson.datatype', name: 'jackson-datatype-jsr310', version: '2.21.3'
  functionalTestImplementation group: 'io.qameta.allure', name: 'allure-junit5', version: '2.34.0'
  functionalTestImplementation group: 'io.qameta.allure', name: 'allure-rest-assured', version: '2.34.0'
}

tasks.named('test') {
  systemProperty 'allure.label.parentSuite', 'Unit tests'
}
tasks.named('integration') {
  systemProperty 'allure.label.parentSuite', 'Integration tests'
}
tasks.named('smoke') {
  systemProperty 'allure.label.parentSuite', 'Smoke tests'
}
tasks.named('functional') {
  systemProperty 'allure.label.parentSuite', 'Functional tests'
}

bootJar {
  archiveFileName = "fact-data-api.jar"

  manifest {
    attributes('Implementation-Version': project.version.toString())
  }
}

// Gradle 7.x issue, workaround from: https://github.com/gradle/gradle/issues/17236#issuecomment-894768083
rootProject.tasks.named("processSmokeTestResources") {
  duplicatesStrategy = 'include'
}

// Gradle 7.x issue, workaround from: https://github.com/gradle/gradle/issues/17236#issuecomment-894768083
rootProject.tasks.named("processIntegrationTestResources") {
  duplicatesStrategy = 'include'
}

// Gradle 7.x issue, workaround from: https://github.com/gradle/gradle/issues/17236#issuecomment-894768083
rootProject.tasks.named("processFunctionalTestResources") {
  duplicatesStrategy = 'include'
}

wrapper {
  distributionType = Wrapper.DistributionType.ALL
}

dependencyManagement {
  dependencies {
    // CVE-2025-48976
    dependency group: 'commons-fileupload', name: 'commons-fileupload', version: '1.6.0'
  }
}