build.gradle

import com.github.benmanes.gradle.versions.updates.DependencyUpdatesTask

plugins {
    id 'org.springframework.boot' version "${springBootVersion}"
    id 'java'
    id 'idea'
    id "org.cyclonedx.bom" version "1.10.0"
    id "org.owasp.dependencycheck" version "11.1.0"
    id "com.github.ben-manes.versions" version "0.51.0"
}

apply plugin: 'io.spring.dependency-management'

group = 'de.novatec'
version = '2.4'

java {
    sourceCompatibility = '17'
}

repositories {
    mavenCentral()
}

test {
    useJUnitPlatform()
}


// We only use snakeyaml transitively, but we want to force the
// current version due to existing CVEs.
// According to https://github.com/spring-projects/spring-boot/issues/34405
// this is a safe
ext['snakeyaml.version'] = '2.3'

dependencies {
    annotationProcessor("org.projectlombok:lombok:${lombokVersion}")
    compileOnly("org.projectlombok:lombok:${lombokVersion}")

    implementation(
            'org.springframework.boot:spring-boot-starter-web',
            'org.springframework.boot:spring-boot-starter-actuator',
            'org.springframework.boot:spring-boot-starter-validation',

            "org.apache.commons:commons-text:${commonsTextVersion}",
            "org.influxdb:influxdb-java:${influxdbJavaVersion}",
    )

    testImplementation("org.springframework.boot:spring-boot-starter-test")
}

dependencyCheck {
    failBuildOnCVSS = 6
    analyzers {
        assemblyEnabled = false
        ossIndex {
            enabled = true
        }
    }
    nvd {
        apiKey = System.getenv("NVD_API_TOKEN")
        delay = 10000
    }
}

def isNonStable = { String candidate ->
    def stableKeyword = ['RELEASE', 'FINAL', 'GA', 'JRE'].any { it -> candidate.toUpperCase().contains(it) }
    def versionRegex = /^[0-9,.v-]+(-r)?$/
    return !stableKeyword && !(candidate ==~ versionRegex)
}

def isNotSameMajorMinor = { String current, String candidate, boolean matchMinor ->
    if(current.equals(candidate)) return false

    def firstDot = current.indexOf('.')
    def secondDot = current.indexOf('.', firstDot + 1)
    def major = current.substring(0, firstDot)
    def minor = current.substring(firstDot + 1, secondDot)
    def majorRegex = /^$major\..*/
    def minorRegex = /^$major\.${minor}\..*/
    return !((candidate ==~ majorRegex) && (!matchMinor || (candidate ==~ minorRegex)))
}

tasks.named("dependencyUpdates").configure {
    rejectVersionIf {
        // only patch updates
        isNonStable(it.candidate.version) || isNotSameMajorMinor(it.currentVersion, it.candidate.version, true)
    }
}

tasks.register('dependencyUpdatesMinor', DependencyUpdatesTask) {
    rejectVersionIf {
        // only minor updates
        isNonStable(it.candidate.version) || isNotSameMajorMinor(it.currentVersion, it.candidate.version, false)
    }
}

tasks.register('dependencyUpdatesMajor', DependencyUpdatesTask) {
    rejectVersionIf {
        // all updates including major updates
        isNonStable(it.candidate.version)
    }
}

tasks.withType(DependencyUpdatesTask).configureEach {
    // default settings
    revision = 'milestone'
    gradleReleaseChannel = "current"
    checkConstraints = true
    checkBuildEnvironmentConstraints = true
    outputFormatter = 'json,plain'
    outputDir = 'build/reports'
    reportfileName = 'dependencyUpdates'
}

cyclonedxBom {
    includeConfigs = ["runtimeClasspath"]
    schemaVersion = "1.4"
    outputName = "bom"
    outputFormat = "all"
}

tasks.register("packageBoms", Zip) {
    archiveFileName.set("software-bill-of-materials.zip")
    from(cyclonedxBom.outputs){
        include ("bom.*")
    }
}

tasks.register("release", Copy) {
    dependsOn packageBoms
    from(bootJar.outputs)
    from(packageBoms.outputs)
    into(layout.buildDirectory.dir("release"))
}