Removed th2 gradle plugin to avoid cycle dependency

.github/workflows/java-publish-sonatype.yml → .github/workflows/build-dev-release.yml

@@ -1,22 +1,17 @@
-name: Build and release Java distributions to sonatype.
+name: Build and publish dev release jar to sonatype repository
 
-on:
-  push:
-    branches:
-      - master
-      - version-*
-    paths:
-      - gradle.properties
+on: workflow_dispatch
 
 jobs:
   build:
     uses: th2-net/.github/.github/workflows/compound-java.yml@main
     with:
       build-target: 'Sonatype'
-      runsOn: ubuntu-latest
-      gradleVersion: '7'
+      devRelease: true
+      createTag: true
     secrets:
       sonatypeUsername: ${{ secrets.SONATYPE_NEXUS_USERNAME }}
       sonatypePassword: ${{ secrets.SONATYPE_NEXUS_PASSWORD }}
       sonatypeSigningKey: ${{ secrets.SONATYPE_GPG_ARMORED_KEY }}
       sonatypeSigningPassword: ${{ secrets.SONATYPE_SIGNING_PASSWORD }}
+      nvd-api-key: ${{ secrets.NVD_APIKEY }}

.github/workflows/build-release.yml

@@ -0,0 +1,17 @@
+name: Build and publish release jar to sonatype repository
+
+on: workflow_dispatch
+
+jobs:
+  build:
+    uses: th2-net/.github/.github/workflows/compound-java.yml@main
+    with:
+      build-target: 'Sonatype'
+      devRelease: false
+      createTag: true
+    secrets:
+      sonatypeUsername: ${{ secrets.SONATYPE_NEXUS_USERNAME }}
+      sonatypePassword: ${{ secrets.SONATYPE_NEXUS_PASSWORD }}
+      sonatypeSigningKey: ${{ secrets.SONATYPE_GPG_ARMORED_KEY }}
+      sonatypeSigningPassword: ${{ secrets.SONATYPE_SIGNING_PASSWORD }}
+      nvd-api-key: ${{ secrets.NVD_APIKEY }}

.github/workflows/dev-java-publish-sonatype.yml → .github/workflows/build-sanpshot.yml

@@ -1,13 +1,11 @@
-name: Dev build and publish Java distributions to sonatype snapshot repository
+name: Build and publish jar to sonatype snapshot repository
 
 on:
   push:
     branches-ignore:
-    - master
-    - version-*
-    - dependabot*
-    # paths:
-    # - gradle.properties
+      - master
+      - version-*
+      - dependabot*
     paths-ignore:
       - README.md
 
@@ -16,10 +14,9 @@ jobs:
     uses: th2-net/.github/.github/workflows/compound-java-dev.yml@main
     with:
       build-target: 'Sonatype'
-      runsOn: ubuntu-latest
-      gradleVersion: '7'
     secrets:
       sonatypeUsername: ${{ secrets.SONATYPE_NEXUS_USERNAME }}
       sonatypePassword: ${{ secrets.SONATYPE_NEXUS_PASSWORD }}
       sonatypeSigningKey: ${{ secrets.SONATYPE_GPG_ARMORED_KEY }}
-      sonatypeSigningPassword: ${{ secrets.SONATYPE_SIGNING_PASSWORD }}
+      sonatypeSigningPassword: ${{ secrets.SONATYPE_SIGNING_PASSWORD }}
+      nvd-api-key: ${{ secrets.NVD_APIKEY }}

.github/workflows/ci-unwelcome-words.yml

@@ -7,9 +7,11 @@ jobs:
   test:
     runs-on: ubuntu-20.04
     steps:
-    - uses: actions/checkout@v2
+    - uses: actions/checkout@v4
+      with:
+        ref: ${{ github.sha }}
     - name: Checkout tool
-      uses: actions/checkout@v2
+      uses: actions/checkout@v4
       with:
         repository: exactpro-th2/ci-github-action
         ref: master
@@ -18,4 +20,4 @@ jobs:
     - name: Run CI action
       uses: ./ci-github-action
       with:
-        ref: ${{ github.ref }}
+        ref: ${{ github.sha }}

.github/workflows/dependabot-java-build.yml

@@ -0,0 +1,20 @@
+name: Dependabot build check
+
+on:
+  push:
+    branches:
+      - dependabot*
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+
+    steps:
+      - uses: actions/checkout@v4
+      # Build package
+      - name: Set up JDK 11
+        uses: actions/setup-java@v1
+        with:
+          java-version: '11'
+      - name: Build with Gradle
+        run: ./gradlew --info clean build

Dockerfile

@@ -1,4 +1,4 @@
-FROM gradle:6.6-jdk11 AS build
+FROM gradle:8.7-jdk11 AS build
 ARG release_version
 ARG bintray_user
 ARG bintray_key

README.md

@@ -1,4 +1,4 @@
-# Overview (3.5.1)
+# Overview (3.7.0)
 
 This project implements a **protoc** plugin to generate services for gRPC router. It generates wrappers for Java's and
 Python's gRPC implementation. You can plug it directly to protoc or run it from the command line itself.
@@ -74,6 +74,20 @@ protobuf {
 
 ## Release notes
 
+### 3.7.0
+
+* Removed th2 gradle plugin to avoid cycle dependency 
+* Updated libs:
+  * bom: `4.7.0`
+  * kotlin-logging: `5.1.4`
+* Updated plugins:
+  * io.github.gradle-nexus.publish-plugin: `2.0.0`
+  * com.github.johnrengelman.shadow: `8.1.1`
+  * org.owasp.dependencycheck: `10.0.4`
+  * com.github.jk1.dependency-license-report:`2.9`
+  * de.undercouch.download: `5.6.0`
+  * com.gorylenko.gradle-git-properties: `2.4.2`
+
 ### 3.6.1
 
 * Update bom 4.6.0 -> 4.6.1

build.gradle

@@ -1,11 +1,20 @@
+import com.github.jk1.license.filter.LicenseBundleNormalizer
+import com.github.jk1.license.render.JsonReportRenderer
+
 plugins {
+    id 'java'
     id 'idea'
     id 'application'
     id 'java-library'
     id 'maven-publish'
+    id "io.github.gradle-nexus.publish-plugin" version "2.0.0"
+    id 'signing'
     id 'org.jetbrains.kotlin.jvm' version "1.8.22"
-    id 'com.github.johnrengelman.shadow' version '7.1.2'
-    id 'com.exactpro.th2.gradle.publish' version '0.0.5'
+    id 'com.github.johnrengelman.shadow' version '8.1.1'
+    id "org.owasp.dependencycheck" version "10.0.4"
+    id 'com.github.jk1.dependency-license-report' version "2.9"
+    id 'de.undercouch.download' version "5.6.0"
+    id "com.gorylenko.gradle-git-properties" version "2.4.2"
 }
 
 group = 'com.exactpro.th2'
@@ -33,6 +42,7 @@ repositories {
 }
 
 dependencies {
+    api platform('com.exactpro.th2:bom:4.7.0')
 
     // Grpc and Protobuf
     api "com.google.protobuf:protobuf-java-util"
@@ -46,29 +56,188 @@ dependencies {
     implementation "org.slf4j:slf4j-api"
 
     //Kotlin
-    implementation 'io.github.microutils:kotlin-logging:3.0.5'
+    implementation 'io.github.oshai:kotlin-logging:5.1.4'
 
     //For generation java code. License: Apache 2.0
     implementation "com.squareup:javapoet:1.13.0"
 
     implementation "commons-io:commons-io"
 
-    testImplementation 'org.junit.jupiter:junit-jupiter:5.10.2'
+    testImplementation 'org.junit.jupiter:junit-jupiter:5.11.0'
+}
+
+manifest {
+    attributes(
+            'Created-By': "${System.getProperty('java.version')} (${System.getProperty('java.vendor')})",
+            'Specification-Title': '',
+            'Specification-Vendor': 'Exactpro Systems LLC',
+            'Implementation-Title': project.archivesBaseName,
+            'Implementation-Vendor': 'Exactpro Systems LLC',
+            'Implementation-Vendor-Id': 'com.exactpro',
+            'Implementation-Version': project.version
+    )
 }
 
 test {
     useJUnitPlatform()
 }
 
+java {
+    withJavadocJar()
+    withSourcesJar()
+}
+
 javadoc {
     (options as StandardJavadocDocletOptions).addBooleanOption("html5", true)
 }
 
-mainClassName = "com.exactpro.th2.service.generator.protoc.Main"
+// conditionals for publications
+tasks.withType(PublishToMavenRepository).configureEach {
+    onlyIf {
+        (repository == publishing.repositories.nexusRepository &&
+                project.hasProperty('nexus_user') &&
+                project.hasProperty('nexus_password') &&
+                project.hasProperty('nexus_url')) ||
+                (repository == publishing.repositories.sonatype &&
+                        project.hasProperty('sonatypeUsername') &&
+                        project.hasProperty('sonatypePassword'))
+    }
+}
+tasks.withType(Sign).configureEach {
+    onlyIf {
+        project.hasProperty('signingKey') &&
+                project.hasProperty('signingPassword')
+    }
+}
+// disable running task 'initializeSonatypeStagingRepository' on a gitlab
+tasks.configureEach { task ->
+    if (task.name == 'initializeSonatypeStagingRepository' &&
+            !(project.hasProperty('sonatypeUsername') && project.hasProperty('sonatypePassword'))
+    ) {
+        task.enabled = false
+    }
+}
+
+publishing {
+    publications {
+        mavenJava(MavenPublication) {
+            from(components.java)
+            pom {
+                name = rootProject.name
+                packaging = 'jar'
+                description = rootProject.description
+                url = vcs_url
+                scm {
+                    url = vcs_url
+                }
+                licenses {
+                    license {
+                        name = 'The Apache License, Version 2.0'
+                        url = 'http://www.apache.org/licenses/LICENSE-2.0.txt'
+                    }
+                }
+                developers {
+                    developer {
+                        id = 'developer'
+                        name = 'developer'
+                        email = 'developer@exactpro.com'
+                    }
+                }
+                scm {
+                    url = vcs_url
+                }
+            }
+        }
+    }
+    repositories {
+        //Nexus repo to publish from gitlab
+        maven {
+            name = 'nexusRepository'
+            credentials {
+                username = project.findProperty('nexus_user')
+                password = project.findProperty('nexus_password')
+            }
+            url = project.findProperty('nexus_url')
+        }
+    }
+}
+
+nexusPublishing {
+    repositories {
+        sonatype {
+            nexusUrl.set(uri("https://s01.oss.sonatype.org/service/local/"))
+            snapshotRepositoryUrl.set(uri("https://s01.oss.sonatype.org/content/repositories/snapshots/"))
+        }
+    }
+}
+
+signing {
+    String signingKey = findProperty("signingKey")
+    String signingPassword = findProperty("signingPassword")
+    useInMemoryPgpKeys(signingKey, signingPassword)
+    sign publishing.publications.mavenJava
+}
+
+application {
+    mainClassName = "com.exactpro.th2.service.generator.protoc.Main"
+}
 
 shadowJar {
     mergeServiceFiles()
 
+    manifest {
+        attributes(
+                'Created-By': "${System.getProperty('java.version')} (${System.getProperty('java.vendor')})",
+                'Specification-Title': '',
+                'Specification-Vendor': 'Exactpro Systems LLC',
+                'Implementation-Title': project.archivesBaseName,
+                'Implementation-Vendor': 'Exactpro Systems LLC',
+                'Implementation-Vendor-Id': 'com.exactpro',
+                'Implementation-Version': project.version
+        )
+    }
+
     archiveFileName = project.name
     destinationDirectory = "$buildDir/artifacts" as File
 }
+
+dependencyLocking {
+    lockAllConfigurations()
+}
+
+dependencyCheck {
+    formats = ['SARIF', 'JSON', 'HTML']
+    failBuildOnCVSS = 5
+
+    nvd {
+        apiKey = project.findProperty("nvdApiKey") as String
+        delay = Integer.valueOf(project.findProperty("nvdDelay") as String)
+    }
+
+    analyzers {
+        assemblyEnabled = false
+        nugetconfEnabled = false
+        nodeEnabled = false
+    }
+}
+
+licenseReport {
+    def licenseNormalizerBundlePath = "$buildDir/license-normalizer-bundle.json"
+
+    if (!file(licenseNormalizerBundlePath).exists()) {
+        download.run {
+            src 'https://raw.githubusercontent.com/th2-net/.github/main/license-compliance/gradle-license-report/license-normalizer-bundle.json'
+            dest "$buildDir/license-normalizer-bundle.json"
+            overwrite false
+        }
+    }
+
+    filters = [
+            new LicenseBundleNormalizer(licenseNormalizerBundlePath, false)
+    ]
+    renderers = [
+            new JsonReportRenderer('licenses.json', false),
+    ]
+    excludeOwnGroup = false
+    allowedLicensesFile = new URL("https://raw.githubusercontent.com/th2-net/.github/main/license-compliance/gradle-license-report/allowed-licenses.json")
+}

gradle.properties

@@ -1,3 +1,5 @@
-release_version=3.6.1
+release_version=3.7.0
 description='th2 gRPC service generator'
 vcs_url=https://github.com/th2-net/th2-grpc-service-generator
+nvdApiKey=
+nvdDelay=10000

gradle/wrapper/gradle-wrapper.properties

@@ -1,6 +1,6 @@
-#Thu Jul 02 11:31:27 GMT+04:00 2020
-distributionUrl=https\://services.gradle.org/distributions/gradle-7.6-all.zip
 distributionBase=GRADLE_USER_HOME
 distributionPath=wrapper/dists
-zipStorePath=wrapper/dists
+distributionUrl=https\://services.gradle.org/distributions/gradle-8.7-bin.zip
+networkTimeout=10000
 zipStoreBase=GRADLE_USER_HOME
+zipStorePath=wrapper/dists