build.gradle

plugins {
    id 'java'
    alias(libs.plugins.nexus.publish)
}

apply from: "${rootDir}/gradle/publish-root.gradle"

allprojects {
    group = 'com.getyourguide.openapi.validation'
    description = 'OpenAPI Validation library'
    // Use version from GitHub tag if provided, otherwise use default version
    version = System.getenv('GH_TAG') ? System.getenv('GH_TAG').replaceFirst('^v', '') : '0-SNAPSHOT'

    java {
        toolchain {
            languageVersion = JavaLanguageVersion.of(libs.versions.java.get())
        }
    }

    repositories {
        mavenCentral()
    }
}

subprojects {
    configurations.configureEach {
        resolutionStrategy.eachDependency {
            if (requested.group == 'tools.jackson.core'
                    && requested.version != null && requested.version < '3.1.5') {
                useVersion('3.1.5')
                because('GHSA-2m67-wjpj-xhg9: Jackson Core 3.0.0-3.1.0 maxDocumentLength bypass; ' +
                        'GHSA-j3rv-43j4-c7qm / GHSA-rmj7-2vxq-3g9f / GHSA-hgj6-7826-r7m5 / GHSA-5jmj-h7xm-6q6v / ' +
                        'GHSA-rcqc-6cw3-h962 / GHSA-9fxm-vc8v-hj55 / GHSA-5hh8-q8hv-fr38 / GHSA-5gvw-p9qm-jgwh: jackson-databind 3.x deserialization vulnerabilities')
            }
            if (requested.group == 'com.fasterxml.jackson.core' && requested.name == 'jackson-databind'
                    && requested.version != null && requested.version < '2.21.5') {
                useVersion('2.21.5')
                because('GHSA-j3rv-43j4-c7qm / GHSA-rmj7-2vxq-3g9f / GHSA-hgj6-7826-r7m5 / GHSA-5jmj-h7xm-6q6v / ' +
                        'GHSA-rcqc-6cw3-h962 / GHSA-9fxm-vc8v-hj55 / GHSA-5hh8-q8hv-fr38: jackson-databind 2.x deserialization vulnerabilities')
            }
            if (requested.group == 'ch.qos.logback'
                    && requested.version != null && requested.version < '1.5.34') {
                useVersion('1.5.34')
                because('GHSA-p47f-322f-whfh / GHSA-jhq6-gfmj-v8fx: logback-core deserialization of untrusted data / object injection')
            }
            if (requested.group == 'org.apache.tomcat.embed' && requested.name == 'tomcat-embed-core'
                    && requested.version != null && requested.version < '11.0.25') {
                useVersion('11.0.25')
                because('GHSA-rv64-5gf8-9qq8 / GHSA-x4m4-345f-5h5g / GHSA-24j9-x2wg-9qv6 / GHSA-gx5v-xp9w-j4cg / GHSA-gcx9-497g-6cp6: Apache Tomcat < 11.0.25 vulnerabilities')
            }
            if (requested.group == 'io.netty'
                    && requested.version != null && requested.version < '4.2.17.Final') {
                useVersion('4.2.17.Final')
                because('GHSA-38f8-5428-x5cv: HTTP Request Smuggling in io.netty:netty-codec-http via malformed Transfer-Encoding headers; ' +
                        'GHSA-3qp7-7mw8-wx86 / GHSA-c2rx-5r8w-8xr2 / GHSA-cmm3-54f8-px4j / GHSA-x4gw-5cx5-pgmh / GHSA-676x-f7gg-47vc / ' +
                        'GHSA-5pvg-856g-cp85 / GHSA-4grm-h2qv-h6w6 / GHSA-c653-97m9-rcg9 / GHSA-563q-j3cm-6jxm / GHSA-hvcg-qmg6-jm4c / ' +
                        'GHSA-cq4q-cv5g-r8q5 / GHSA-c2gf-v879-257j / GHSA-5x3r-wrvg-rp6q / GHSA-xmv7-r254-6q78 / GHSA-w573-9ffj-6ff9 / ' +
                        'GHSA-mvh2-crg5-v77c / GHSA-8c42-7qj2-3j46: multiple Netty vulnerabilities, including SPDY zlib header block continues decoded expansion ' +
                        'after maxHeaderSize truncation and CORS Vary Header Overwrite cache poisoning, fixed in 4.2.17.Final')
            }
            if (requested.group == 'org.springframework' && requested.name == 'spring-core'
                    && requested.version != null && requested.version < '7.0.8') {
                useVersion('7.0.8')
                because('GHSA-659m-px2c-25wj: Denial of Service in spring-core via AntPathMatcher, fixed in 7.0.8')
            }
            if (requested.group == 'org.apache.logging.log4j'
                    && requested.version != null && requested.version < '2.25.5') {
                useVersion('2.25.5')
                because('GHSA-qv9r-c865-cp47: improper encoding of non-finite floating-point values during MapMessage JSON serialization, fixed in 2.25.5')
            }
        }
    }

    if(it.parent.name == 'examples') {
        apply plugin: 'java'
    } else {
        apply plugin: 'java-library'
        apply plugin: 'jacoco'

        dependencies {
            // Testing
            testImplementation(libs.junit.jupiter.api)
            testRuntimeOnly(libs.junit.jupiter.engine)
            testRuntimeOnly(libs.junit.platform.launcher)
            testImplementation(libs.mockito.core)
            testImplementation(libs.mockito.junit.jupiter)
        }

        jacoco {
            toolVersion = libs.versions.jacoco.get()
        }

        jacocoTestReport {
            reports {
                xml.required = true
                csv.required = false
                html.required = true
            }
        }

        test {
            useJUnitPlatform()
        }
    }

    apply plugin: 'checkstyle'
    apply plugin: 'pmd'

    dependencies {
        // Lombok annotations to reduce boilerplate code
        compileOnly(libs.lombok)
        annotationProcessor(libs.lombok)
        testCompileOnly(libs.lombok)
        testAnnotationProcessor(libs.lombok)
    }

    checkstyle {
        toolVersion = libs.versions.checkstyle.get()
        configDirectory.set(file("$rootProject.projectDir/config"))
        checkstyleMain.source = "src/main/java"
        checkstyleMain.exclude('**/build/generated/**')
        checkstyleTest.source = "src/main/java"
        checkstyleTest.exclude('**/build/generated/**')
    }

    pmd {
        toolVersion = libs.versions.pmd.get()
        consoleOutput = true
        ruleSets = ["$rootDir/ruleset.xml"]
    }
}