build.gradle

import com.github.spotbugs.snom.Confidence
import com.github.spotbugs.snom.Effort
buildscript {
    repositories {
        mavenCentral()
    }
    dependencies {
        constraints {
            classpath('org.apache.commons:commons-lang3:[3.18.0,)') {
                because 'CVE-2025-48924 is fixed in org.apache.commons:commons-lang3:3.18.0 and higher'
            }
        }
    }
}

plugins {
    alias libs.plugins.spotless
    alias libs.plugins.dockerCompose
    alias libs.plugins.sonar
    id "jacoco-report-aggregation"
    alias libs.plugins.spotbugs
}

apply plugin: "java"
apply plugin: "application"
apply plugin: "idea"

ext {
    terraformEnvironment = project.properties["terraformEnvironment"] ?: "localstack"

    awsCredentialsEnvironment = terraformEnvironment == "localstack" ? [
        AWS_ACCESS_KEY_ID: "mockaccesskey",
        AWS_SECRET_ACCESS_KEY: "mocksecretkey",
    ] : [:]

    noXray = {
        exclude group: "com.amazonaws", module: "aws-xray-recorder-sdk-bom"
        exclude group: "com.amazonaws", module: "aws-xray-recorder-sdk-core"
        exclude group: "com.amazonaws", module: "aws-xray-recorder-sdk-aws-sdk-core"
        exclude group: "com.amazonaws", module: "aws-xray-recorder-sdk-aws-sdk-instrumentor"
        exclude group: "com.amazonaws", module: "aws-xray-recorder-sdk-aws-sdk-v2"
        exclude group: "com.amazonaws", module: "aws-xray-recorder-sdk-aws-sdk-v2-instrumentor"
    }
}

subprojects {
    task allDeps(type: DependencyReportTask) {}
    buildscript {
        dependencies {
            constraints {
                // Netty constraints
                classpath('io.netty:netty-codec-http:[4.1.129.Final,)') {
                    because 'CVE-2025-67735 is fixed in io.netty:netty-codec-http:4.1.129.Final and higher'
                }

                classpath('io.netty:netty-common:[4.1.118.Final,4.2)') {
                    because 'CVE-2025-25193 is fixed in io.netty:netty-common:4.1.118.Final and higher'
                }

                classpath('io.netty:netty-handler:[4.1.118.Final,)') {
                    because 'CVE-2025-24970 is fixed in io.netty:netty-handler:4.1.118.Final and higher'
                }

                classpath('io.netty:netty-codec-http2:[4.1.129.Final,4.2.0)') {
                    because 'CVE-2025-67735 is fixed in io.netty:netty-codec-http2:4.1.129.Final and higher'
                }

                classpath('io.netty:netty-codec:[4.1.125.Final,4.2.0)') {
                    because 'CVE-2025-58057 is fixed in io.netty:netty-codec:4.1.125.Final and higher'
                }

                // Apache Commons constraints
                classpath('commons-beanutils:commons-beanutils:[1.11.0,)') {
                    because 'CVE-2025-48734 is fixed in commons-beanutils:commons-beanutils:1.11.0 and higher'
                }

                classpath('org.apache.commons:commons-lang3:[3.18.0,)') {
                    because 'CVE-2025-48924 is fixed in org.apache.commons:commons-lang3:3.18.0 and higher'
                }

                // Other constraints
                classpath('com.google.protobuf:protobuf-java:[3.25.5,)') {
                    because 'CVE-2024-7254 is fixed in 3.25.5 and above'
                }
            }
        }
    }

    apply plugin: "com.github.spotbugs"
    apply plugin: "java"

    ext {
        isDevDeployBuild = project.hasProperty("devDeployBuild") ? project.getProperty("devDeployBuild").toBoolean() : false
    }

    spotbugs {
        ignoreFailures = false
        showStackTraces = true
        effort = Effort.valueOf('MAX')
        reportLevel = Confidence.valueOf('HIGH')
        excludeFilter = file("$rootProject.projectDir/spotbugsExclude.xml")
    }

    configurations.all {
        exclude group: 'org.apache.tika', module: 'tika-parser-pdf-module'
        exclude group: 'org.apache.commons', module: 'commons-io'
    }

    // Check dependencies using:
    //
    // ./gradlew :frontend-api:dependencyInsight --dependency guava  --configuration testRuntimeClasspath
    // ./gradlew :frontend-api:dependencyInsight --dependency guava  --configuration runtimeClasspath
    //
    dependencies {
        // Unneeded constraints should be removed once no longer required
        // https://discuss.gradle.org/t/dependency-version-constraints-for-all-configurations/34161/3
        constraints {
            configurations.configureEach { conf ->
                if (!conf.canBeConsumed && !conf.canBeResolved) {
                    // Netty constraints
                    add(conf.name, 'io.netty:netty-codec-http:[4.1.129.Final,)') {
                        because 'CVE-2025-67735 is fixed in io.netty:netty-codec-http:4.1.129.Final and higher'
                    }

                    add(conf.name, 'io.netty:netty-common:[4.1.118.Final,4.2)') {
                        because 'CVE-2025-25193 is fixed in io.netty:netty-common:4.1.118.Final and higher'
                    }

                    add(conf.name, 'io.netty:netty-handler:[4.1.118.Final,)') {
                        because 'CVE-2025-24970 is fixed in io.netty:netty-handler:4.1.118.Final and higher'
                    }

                    add(conf.name, 'io.netty:netty-codec-http2:[4.1.129.Final,4.2.0)') {
                        because 'CVE-2025-67735 is fixed in io.netty:netty-codec-http2:4.1.129.Final and higher'
                    }

                    add(conf.name, 'io.netty:netty-codec:[4.1.125.Final,4.2.0)') {
                        because 'CVE-2025-58057 is fixed in io.netty:netty-codec:4.1.125.Final and higher'
                    }

                    // Jetty constraints
                    add(conf.name, 'org.eclipse.jetty.http2:jetty-http2-common:[12.0.25,12.1.0)') {
                        because 'CVE-2025-5115 is fixed in org.eclipse.jetty.http2:jetty-http2-common:12.0.25 and higher'
                    }

                    add(conf.name, 'org.eclipse.jetty:jetty-server:[12.0.32,)') {
                        because 'CVE-2026-1605 is fixed in org.eclipse.jetty:jetty-server:12.0.32 and higher'
                    }

                    add(conf.name, 'org.eclipse.jetty:jetty-http:[12.0.33,12.1.0)') {
                        because 'CVE-2026-2332 is fixed in org.eclipse.jetty:jetty-http:12.0.33'
                    }

                    // Jackson constraints
                    add(conf.name, 'com.fasterxml.jackson.core:jackson-databind:[2.12.7.1,)') {
                        because 'CVE-2022-42003 is fixed in 2.12.7.1 and above'
                    }

                    add(conf.name, 'com.fasterxml.jackson.core:jackson-core:[2.21.1,)') {
                        because 'GHSA-72hv-8253-57qq is fixed in com.fasterxml.jackson.core:jackson-core:2.21.1 and higher'
                    }

                    // Apache Commons constraints
                    add(conf.name, 'commons-beanutils:commons-beanutils:[1.11.0,)') {
                        because 'CVE-2025-48734 is fixed in commons-beanutils:commons-beanutils:1.11.0 and higher'
                    }

                    add(conf.name, 'org.apache.commons:commons-lang3:[3.18.0,)') {
                        because 'CVE-2025-48924 is fixed in org.apache.commons:commons-lang3:3.18.0 and higher'
                    }

                    add(conf.name, 'commons-io:commons-io:[2.21.0,)') {
                        because 'CVE-2021-29425 is fixed in commons-io:commons-io:2.21.0 and higher'
                    }

                    // Other constraints
                    add(conf.name, 'com.google.protobuf:protobuf-java:[3.25.5,)') {
                        because 'CVE-2024-7254 is fixed in 3.25.5 and above'
                    }

                    add(conf.name, 'org.apache.logging.log4j:log4j-core:[2.25.4,3.0.0)') {
                        because 'CVE-2026-34480 is fixed in 2.25.4 and higher'
                    }
                }
            }
        }

        constraints {
            spotbugs('org.apache.logging.log4j:log4j-core:[2.25.4,3.0.0)') {
                because 'CVE-2026-34480 is fixed in 2.25.4 and higher'
            }
        }

        spotbugs libs.spotbugs
        spotbugsPlugins "software.amazon.lambda.snapstart:aws-lambda-snapstart-java-rules:0.2.1"
    }
}

allprojects {
    gradle.projectsEvaluated {
        tasks.withType(JavaCompile) {
            options.compilerArgs << "-Xlint:deprecation" << "-Werror"
        }
        tasks.withType(AbstractArchiveTask) {
            // Ensure that the jar / zip files are reproducible
            includeEmptyDirs = false
            preserveFileTimestamps = false
            reproducibleFileOrder = true
        }
    }
}

spotless {
    java {
        target "**/*.java"
        googleJavaFormat("1.18.0").aosp()
        importOrder "", "javax", "java", "\\#"
    }

    groovyGradle {
        target "**/*.gradle"
        greclipse().configFile("tools/spotless-gradle.properties")
    }
}

dockerCompose {
    buildBeforeUp = true
    forceRecreate = false

    if (System.getProperty("os.arch") == "aarch64") {
        useComposeFiles = [
            "docker-compose.yml",
            "docker-compose.arm64.yml"
        ]
    }

    startedServices = [
        'aws',
        'dynamodb',
        'redis'
    ]
    def logDir = new File(project.buildDir, "logs")
    if (!logDir.exists()) {
        println("creating logs folder...")
        logDir.mkdir()
    }
    captureContainersOutput = false
    captureContainersOutputToFile = new File('logs', 'docker-compose-gradle.log')
    projectName = rootProject.rootDir.name
}

compileJava.dependsOn "spotlessApply"

clean.dependsOn "composeDown"

abstract class Terraform extends DefaultTask {

    Terraform() {
        group = "terraform"
    }

    @Input
    abstract MapProperty<String, String> getEnvironmentVars()

    @InputDirectory
    abstract DirectoryProperty getTerraformDirectory()

    @Input
    abstract Property<String> getEnvironmentName()

    @Internal
    Object terraformOutputs

    @TaskAction
    void apply() {
        def tfEnvironment = [
            "TF_DATA_DIR": "${project.buildDir}/terraform/${environmentName.get()}-${terraformDirectory.get().asFile.name}",
            "TF_IN_AUTOMATION": "1"
        ] + environmentVars.get()

        logger.lifecycle("Running Terraform Initialise...")
        project.exec {
            executable "terraform"
            workingDir terraformDirectory.asFile
            environment tfEnvironment
            args "init", "-backend-config=${environmentName.get()}.hcl"
        }

        logger.lifecycle("Applying ${terraformDirectory.getAsFile().get().name} Terraform (run gradle with --info to see output)...")
        project.exec {
            logging.captureStandardOutput(LogLevel.INFO)
            executable "terraform"
            workingDir terraformDirectory.asFile
            environment tfEnvironment
            args "apply", "-auto-approve", "-var-file=${environmentName.get()}.tfvars"
        }

        logger.lifecycle("Getting Terraform Outputs!")
        new ByteArrayOutputStream().withStream { os ->
            project.exec {
                standardOutput os
                executable "terraform"
                workingDir terraformDirectory.asFile
                environment tfEnvironment
                args "output", "-json"
            }
            this.terraformOutputs = new groovy.json.JsonSlurper().parse(os.toByteArray())
        }
        logger.lifecycle("Terraform Complete!")
    }

    protected Object outputs() {
        return this.terraformOutputs
    }
}

task sharedTerraform (type: Terraform) {
    terraformDirectory = layout.projectDirectory.dir("ci/terraform/shared")
    environmentName = terraformEnvironment
    environmentVars = awsCredentialsEnvironment

    if (terraformEnvironment == "localstack") {
        dependsOn "composeUp"
    }
}

task oidcTerraform (type: Terraform) {
    terraformDirectory = layout.projectDirectory.dir("ci/terraform/oidc")
    environmentName = project.properties["terraformEnvironment"] ?: "localstack"
    environmentVars = awsCredentialsEnvironment

    doLast {
        def json = outputs()
        allprojects.findAll {it.name == "integration-tests"}.first().tasks.getByName("test") {
            environment "API_GATEWAY_ID", json.api_gateway_root_id.value
            environment "EXTERNAL_TOKEN_SIGNING_KEY_ALIAS", json.id_token_signing_key_alias.value
            environment "OIDC_API_BASE_URL", json.base_url.value
            environment "API_KEY", json.frontend_api_key.value
            environment "FRONTEND_API_GATEWAY_ID", json.frontend_api_gateway_root_id.value
            environment "FRONTEND_API_KEY", json.frontend_api_key.value
            environment "EVENTS_SNS_TOPIC_ARN", json.events_sns_topic_arn.value
            environment "EMAIL_QUEUE_URL", json.email_queue.value
            environment "EXPERIAN_PHONE_CHECK_QUEUE_URL", json.experian_phone_check_queue.value
        }
        allprojects.findAll {it.name == "account-management-integration-tests"}.first().tasks.getByName("test") {
            environment "EVENTS_SNS_TOPIC_ARN", json.events_sns_topic_arn.value
        }
    }
    dependsOn ":client-registry-api:buildZip"
    dependsOn ":frontend-api:buildZip"
    dependsOn ":oidc-api:buildZip"
    dependsOn ":ipv-api:buildZip"
    dependsOn ":doc-checking-app-api:buildZip"
    dependsOn "sharedTerraform"
}

task acctMgmtTerraform (type: Terraform) {
    terraformDirectory = layout.projectDirectory.dir("ci/terraform/account-management")
    environmentName = project.properties["terraformEnvironment"] ?: "localstack"
    environmentVars = awsCredentialsEnvironment

    doLast {
        def json = outputs()
        allprojects.findAll {it.name == "account-management-integration-tests"}.first().tasks.getByName("test") {
            environment "API_GATEWAY_ID", json.api_gateway_root_id.value
            environment "OIDC_API_BASE_URL", json.base_url.value
            environment "EMAIL_QUEUE_URL", json.email_queue.value
        }
    }
    dependsOn ":account-management-api:buildZip"
    dependsOn "auditTerraform"
}

task utilsTerraform (type: Terraform) {
    terraformDirectory = layout.projectDirectory.dir("ci/terraform/utils")
    environmentName = project.properties["terraformEnvironment"] ?: "localstack"
    environmentVars = awsCredentialsEnvironment

    dependsOn ":utils:buildZip"
    dependsOn "oidcTerraform"
}

String jacocoBuildReportPath = "reports/jacoco/testCodeCoverageReport/testCodeCoverageReport.xml"

sonar {
    properties {
        property "sonar.projectKey", "govuk-one-login_authentication-api"
        property "sonar.organization", "govuk-one-login"
        property "sonar.host.url", "https://sonarcloud.io"
        property "sonar.coverage.exclusions", "**/shared-test/**,**/orchestration-shared-test/**,**/orchestration-shared-test/**"
        property "sonar.coverage.jacoco.xmlReportPaths", "$project.buildDir/$jacocoBuildReportPath"
    }
}

subprojects {
    sonar {
        properties {
            property 'sonar.coverage.jacoco.xmlReportPaths', "$projectDir.parentFile.path/build/$jacocoBuildReportPath"
        }
    }
}

reporting {
    reports {
        testCodeCoverageReport(JacocoCoverageReport) {
            testSuiteName = "test"
        }
    }
}

dependencies {
    jacocoAggregation subprojects

    constraints {
        spotbugs('org.apache.logging.log4j:log4j-core:[2.25.4,)') {
            because 'CVE-2026-34480 is fixed in 2.25.4 and higher'
        }
    }
}

jacocoTestReport {
    reports {
        xml.required = true
    }
    dependsOn "test"
}

task searchForDependency {
    group = 'Custom'
    description = 'Find all projects that have a dependency'

    doLast {
        def targetGroup = project.hasProperty('targetGroup') ? project.property('targetGroup') : null
        def targetName = project.hasProperty('targetName') ? project.property('targetName') : null
        def minVersion = project.hasProperty('minVersion') ? project.property('minVersion') : null
        def parsedMinVersion  = VersionNumber.parse(minVersion)

        println "searching for ${targetGroup}:${targetName} < ${minVersion}\n"

        def foundProjects = new LinkedHashSet<String>()

        allprojects {project ->
            project.configurations.each { config ->
                if (config.canBeResolved) {
                    def resolvedDependencies = config.resolvedConfiguration.lenientConfiguration.allModuleDependencies

                    resolvedDependencies.each { dep ->
                        if (dep.moduleGroup == targetGroup && dep.moduleName == targetName) {
                            def parsedResolvedVersion = VersionNumber.parse(dep.getModuleVersion())
                            def isLower = parsedResolvedVersion < parsedMinVersion
                            def versionString = isLower
                                    ? "Version: \u001B[31m${dep.getModuleVersion()}\u001B[0m ⚠️"
                                    : "Version: \u001B[32m${dep.getModuleVersion()}\u001B[0m ✅"
                            foundProjects.add(project.path + ":" + config.name +". "  + versionString)
                        }
                    }
                }
            }
        }

        foundProjects.each { projectName ->
            println "${projectName}"
        }
    }
}