build.gradle

plugins {
	id 'org.springframework.boot' version '2.7.4'
	id 'io.spring.dependency-management' version '1.0.14.RELEASE'
	id 'java'

	id "net.ltgt.errorprone" version "3.1.0"
	id "org.owasp.dependencycheck" version "7.2.1"

	id "jacoco"
	id "org.sonarqube" version "6.0.1.5171"
}

group = 'de.qaware.cloud'
version = '1.0.0'

sourceCompatibility = '17'

configurations {
	compileOnly {
		extendsFrom annotationProcessor
	}
}

repositories {
	mavenCentral()
}

dependencies {
	implementation 'org.springframework.boot:spring-boot-starter-actuator'
	implementation 'org.springframework.boot:spring-boot-starter-web'
	implementation 'org.springdoc:springdoc-openapi-webmvc-core:1.6.11'

	// for demo purposes to trigger vulnerable library
 	runtimeOnly 'org.apache.logging.log4j:log4j-core:2.20.0'
	runtimeOnly 'org.apache.logging.log4j:log4j-api:2.20.0'

	compileOnly 'org.projectlombok:lombok'
	annotationProcessor 'org.projectlombok:lombok'

	errorprone "com.google.errorprone:error_prone_core:2.19.1"

	testImplementation 'org.springframework.boot:spring-boot-starter-test'
	testImplementation 'org.assertj:assertj-core:3.23.1'
}

tasks.named('test') {
	useJUnitPlatform()
}

tasks.named("bootBuildImage") {
	imageName = "${project.name}:${project.version}"
}

tasks.named("compileTestJava").configure {
    options.errorprone.enabled = false
}
tasks.named("compileJava").configure {
    options.errorprone.enabled = true
}

dependencyCheck {
    cveValidForHours = 24
	failOnError = true
}

test {
    finalizedBy jacocoTestReport // report is always generated after tests run
}
jacocoTestReport {
    dependsOn test // tests are required to run before generating the report
	reports {
		xml.required = true
	}
}

sonar {
  properties {
    property "sonar.projectKey", "lreimer_secure-devex22"
    property "sonar.organization", "lreimer"
    property "sonar.host.url", "https://sonarcloud.io"
  }
}