build.gradle.kts

/********************************************************************************
 * Copyright (c) 2023 Contributors to the Eclipse Foundation
 * Copyright (c) 2026 Cofinity-X GmbH
 *
 * See the NOTICE file(s) distributed with this work for additional
 * information regarding copyright ownership.
 *
 * This program and the accompanying materials are made available under the
 * terms of the Apache License, Version 2.0 which is available at
 * https://www.apache.org/licenses/LICENSE-2.0.
 *
 * Unless required by applicable law or agreed to in writing, software
 * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
 * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
 * License for the specific language governing permissions and limitations
 * under the License.
 *
 * SPDX-License-Identifier: Apache-2.0
 ********************************************************************************/

import com.bmuschko.gradle.docker.tasks.image.DockerBuildImage

plugins {
    checkstyle
    `java-library`
    `maven-publish`
    jacoco
    `jacoco-report-aggregation`
    `java-test-fixtures`
    alias(libs.plugins.shadow) apply false
    alias(libs.plugins.docker)
    alias(libs.plugins.edc.build)
}

val txScmConnection: String by project
val txWebsiteUrl: String by project
val txScmUrl: String by project
val edcVersion = libs.versions.edc

buildscript {
    repositories {
        mavenLocal()
    }
    dependencies {
        val edcVersion: String = libs.versions.edc.asProvider().get()
        classpath("org.eclipse.edc.autodoc:org.eclipse.edc.autodoc.gradle.plugin:$edcVersion")
    }
}

// include all subprojects in the jacoco report aggregation
project.subprojects.forEach {
    dependencies {
        jacocoAggregation(project(it.path))
    }

}

val edcBuildId = libs.plugins.edc.build.get().pluginId

allprojects {
    apply(plugin = edcBuildId)
    apply(plugin = "org.eclipse.edc.autodoc")
    apply(plugin = "jacoco")

    dependencies {
        implementation("org.slf4j:slf4j-api:2.0.18")

        implementation(platform("io.netty:netty-bom:4.1.137.Final")) {
            because("CVE-2026-56819/56745/55833/55831/59901/50010/47691/45674/45416/44249/42587/42584/42579/42583: netty fixed in 4.1.136; CVE-2026-59903 (CorsHandler Vary header cache poisoning) backported to 4.1.137")
        }
        implementation(platform("org.eclipse.jetty:jetty-bom:12.1.10")) {
            because("CVE-2026-10050: jetty-security Digest auth bypass, fixed in 12.1.10")
        }
        implementation(platform("org.eclipse.jetty.ee10:jetty-ee10-bom:12.1.10")) {
            because("CVE-2026-10050: aligns Jetty ee10 modules with jetty-bom 12.1.10")
        }
        implementation(platform("com.fasterxml.jackson:jackson-bom:2.21.4")) {
            because("CVE-2026-54513/54512 + GHSA-r7wm-3cxj-wff9: jackson-databind/core fixed in 2.21.4")
        }

        constraints {
            plugins.apply("org.gradle.java-test-fixtures")
            implementation("org.eclipse.jetty.websocket:jetty-websocket:12.1.10") {
                because("CVE-2026-10050: align jetty-websocket aggregator (not in jetty-bom) with jetty 12.1.10")
            }
        }
    }

    configure<org.eclipse.edc.plugins.autodoc.AutodocExtension> {
        processorVersion.set(edcVersion.asProvider())
        outputDirectory.set(project.layout.buildDirectory.asFile.get())
    }

    configure<org.eclipse.edc.plugins.edcbuild.extensions.BuildExtension> {
        pom {
            projectName.set(project.name)
            description.set("edc :: ${project.name}")
            projectUrl.set(txWebsiteUrl)
            scmConnection.set(txScmConnection)
            scmUrl.set(txScmUrl)
        }
        swagger {
            outputFilename.set(project.name)
            outputDirectory.set(file("${rootProject.projectDir.path}/resources/openapi/yaml"))
            resourcePackages = setOf("org.eclipse.tractusx.edc")
        }
    }

    configure<CheckstyleExtension> {
        configFile = rootProject.file("resources/tx-checkstyle-config.xml")
        configDirectory.set(rootProject.file("resources"))

        // gradle checkstyle plugin only includes java src, so we add allSource and .github folder
        tasks.checkstyleMain {
            this.source = project.sourceSets.main.get().allSource.srcDir(".github")
        }

        tasks.checkstyleTest {
            this.source = project.sourceSets.test.get().allSource
        }

        //checkstyle violations are reported at the WARN level
        this.isShowViolations = System.getProperty("checkstyle.verbose", "true").toBoolean()
    }

}

subprojects {
    afterEvaluate {
        // the "dockerize" task is added to all projects that use the `shadowJar` plugin
        if (project.plugins.hasPlugin(libs.plugins.shadow.get().pluginId)) {
            val downloadOpentelemetryAgent = tasks.register("downloadOpentelemetryAgent", Copy::class) {
                val openTelemetry = configurations.create("open-telemetry")

                dependencies {
                    openTelemetry(libs.opentelemetry.javaagent)
                }

                from(openTelemetry)
                into("build/resources/otel")
                rename { "opentelemetry-javaagent.jar" }
            }

            val copyLegalDocs = tasks.register("copyLegalDocs", Copy::class) {
                from(project.rootProject.projectDir)
                into("build/legal")
                include("SECURITY.md", "NOTICE.md", "DEPENDENCIES", "LICENSE")
            }

            val copyDockerfile = tasks.register("copyDockerfile", Copy::class) {
                from(rootProject.projectDir.toPath().resolve("resources"))
                into(project.layout.buildDirectory.dir("resources").get().dir("docker"))
                include("Dockerfile")
            }

            val shadowJarTask = tasks.named("shadowJar").get()

            shadowJarTask
                .dependsOn(copyDockerfile)
                .dependsOn(copyLegalDocs)
                .dependsOn(downloadOpentelemetryAgent)

            //actually apply the plugin to the (sub-)project
            apply(plugin = libs.plugins.docker.get().pluginId)

            tasks.register("dockerize", DockerBuildImage::class) {
                dockerFile.set(File("build/resources/docker/Dockerfile"))

                val dockerContextDir = project.projectDir
                images.add("${project.name}:${project.version}")
                images.add("${project.name}:latest")

                if (System.getProperty("platform") != null) {
                    platform.set(System.getProperty("platform"))
                }

                buildArgs.put("JAR", "build/libs/${project.name}.jar")
                buildArgs.put("OTEL_JAR", "build/resources/otel/opentelemetry-javaagent.jar")
                buildArgs.put("ADDITIONAL_FILES", "build/legal/*")
                inputDir.set(file(dockerContextDir))

                dependsOn(shadowJarTask)
            }

        }

        if (path.startsWith(":edc-tests")) {
            dependencies {
                testImplementation(libs.allure.junit5)
            }

            tasks.withType<Test> {
                useJUnitPlatform()
                systemProperty("allure.results.directory", layout.buildDirectory.dir("allure-results").get().asFile.absolutePath)
            }
        }

        tasks.withType<Test>().configureEach {
            finalizedBy(rootProject.tasks.named("aggregateAllureResults"))
        }
    }

    tasks.register("downloadOpenapi") {
        outputs.dir(project.layout.buildDirectory.dir("docs/openapi"))
        doLast {
            val destinationDirectory = layout.buildDirectory.asFile.get().toPath()
                .resolve("docs").resolve("openapi")

            configurations.asMap.values
                .filter { it.isCanBeResolved }
                .flatMap { it.resolvedConfiguration.firstLevelModuleDependencies }
                .flatMap { childrenDependencies(it) }
                .distinct()
                .forEach { dep ->
                    downloadYamlArtifact(dep, "management-api", destinationDirectory)
                    downloadYamlArtifact(dep, "observability-api", destinationDirectory)
                    downloadYamlArtifact(dep, "public-api", destinationDirectory)
                }
        }
    }

}

tasks.check {
    dependsOn(tasks.named<JacocoReport>("testCodeCoverageReport"))
}

tasks.register<Copy>("aggregateAllureResults") {
    group = "reporting"
    description = "Aggregates Allure test results from all subprojects into a single folder"
    doFirst {
        project.delete(layout.buildDirectory.dir("allure-results"))
    }

    subprojects.forEach { subproject ->
        from(subproject.layout.buildDirectory.dir("allure-results"))
    }
    into(layout.buildDirectory.dir("allure-results"))
}


fun childrenDependencies(dependency: ResolvedDependency): List<ResolvedDependency> {
    return listOf(dependency) + dependency.children.flatMap { child -> childrenDependencies(child) }
}

fun downloadYamlArtifact(dep: ResolvedDependency, classifier: String, destinationDirectory: java.nio.file.Path) {
    try {
        val managementApiNotation = "${dep.moduleGroup}:${dep.moduleName}:${dep.moduleVersion}:${classifier}@yaml"
        val managementApi = dependencies.create(managementApiNotation)
        configurations
            .detachedConfiguration(managementApi)
            .resolve()
            .forEach { file ->
                destinationDirectory
                    .resolve("${dep.moduleName}.yaml")
                    .toFile()
                    .let(file::copyTo)
            }
    } catch (_: Exception) {
    }
}