build.gradle

import com.github.benmanes.gradle.versions.updates.DependencyUpdatesTask

plugins {
    id 'org.springframework.boot' version "${springBootVersion}"
    id 'java'
    id 'idea'
    id "org.cyclonedx.bom" version "1.7.4"
    id "org.owasp.dependencycheck" version "8.4.0"
    id "com.github.ben-manes.versions" version "0.49.0"
}

apply plugin: 'io.spring.dependency-management'

group = 'de.novatec'
version = '2.2'

java {
    sourceCompatibility = '17'
}

repositories {
    mavenCentral()
}


// We only use snakeyaml transitively, but we want to force the
// current version due to existing CVEs.
// According to https://github.com/spring-projects/spring-boot/issues/34405
// this is a safe
ext['snakeyaml.version'] = '2.0'

dependencies {
    annotationProcessor(
            "org.projectlombok:lombok"
    )

    compileOnly(
            "org.projectlombok:lombok"
    )

    implementation(
            'org.springframework.boot:spring-boot-starter-web',
            'org.springframework.boot:spring-boot-starter-actuator',
            'org.springframework.boot:spring-boot-starter-validation',

            'org.apache.commons:commons-text:1.10.0',
            // If indluxdb-java is updated, check new version of the transitive dependency okio-jvm
            // If there is a higher new version, remove the dependency override of okio-jvm
            "org.influxdb:influxdb-java:${influxdbJavaVersion}",
            // Override transitive dependency with newer version, due to security concerns
            "com.squareup.okio:okio-jvm:${okioJvmVersion}",

    )
}

dependencyCheck {
    failBuildOnCVSS = 6
    analyzers {
        assemblyEnabled = false
        ossIndex {
            enabled = true
        }
    }
}

def isNonStable = { String candidate ->
    def stableKeyword = ['RELEASE', 'FINAL', 'GA', 'JRE'].any { it -> candidate.toUpperCase().contains(it) }
    def versionRegex = /^[0-9,.v-]+(-r)?$/
    return !stableKeyword && !(candidate ==~ versionRegex)
}

def isNotSameMajorMinor = { String current, String candidate, boolean matchMinor ->
    if(current.equals(candidate)) return false

    def firstDot = current.indexOf('.')
    def secondDot = current.indexOf('.', firstDot + 1)
    def major = current.substring(0, firstDot)
    def minor = current.substring(firstDot + 1, secondDot)
    def majorRegex = /^$major\..*/
    def minorRegex = /^$major\.${minor}\..*/
    return !((candidate ==~ majorRegex) && (!matchMinor || (candidate ==~ minorRegex)))
}

tasks.named("dependencyUpdates").configure {
    rejectVersionIf {
        // only patch updates
        isNonStable(it.candidate.version) || isNotSameMajorMinor(it.currentVersion, it.candidate.version, true)
    }
}

tasks.register('dependencyUpdatesMinor', DependencyUpdatesTask) {
    rejectVersionIf {
        // only minor updates
        isNonStable(it.candidate.version) || isNotSameMajorMinor(it.currentVersion, it.candidate.version, false)
    }
}

tasks.register('dependencyUpdatesMajor', DependencyUpdatesTask) {
    rejectVersionIf {
        // all updates including major updates
        isNonStable(it.candidate.version)
    }
}

tasks.withType(DependencyUpdatesTask).configureEach {
    // default settings
    revision = 'milestone'
    gradleReleaseChannel = "current"
    checkConstraints = true
    checkBuildEnvironmentConstraints = true
    outputFormatter = 'json,plain'
    outputDir = 'build/reports'
    reportfileName = 'dependencyUpdates'
}

cyclonedxBom {
    includeConfigs = ["runtimeClasspath"]
    schemaVersion = "1.4"
}

tasks.register("packageBoms", Zip) {
    archiveFileName.set("software-bill-of-materials.zip")
    from(cyclonedxBom.outputs){
        include ("bom.*")
    }
}

tasks.register("release", Copy) {
    dependsOn packageBoms
    from(bootJar.outputs)
    from(packageBoms.outputs)
    into(layout.buildDirectory.dir("release"))
}