ONECOND-2339 Implement SonarQube for SAST

.github/workflows/sonarqube.yml

@@ -1,8 +1,8 @@
 on:
   push:
-    branches: [ main ]
+    branches: [ main, release* ]
   pull_request:
-    branches: [ main ]
+    branches: [ main, release* ]
 jobs:
   build:
     runs-on: ubuntu-latest
@@ -11,9 +11,33 @@ jobs:
         uses: actions/checkout@v2
         with:
           fetch-depth: 0
+
+      # Step to set up JDK 1.8 for building the project
       - name: Set up JDK 1.8
+        id: setup-java-8
         uses: actions/setup-java@v1
         with:
+          distribution: adopt
           java-version: 1.8
+
+      # Use JDK 8 for Gradle build (compile)
+      - name: Build with Gradle
+        run: JAVA_HOME="${{ steps.setup-java-8.outputs.path }}" ./gradlew build -x test
+        env:
+          GIT_USER: ${{ secrets.AM_GPR_USER }}
+          GIT_TOKEN: ${{ secrets.DELUXE_ORG_GPR_TOKEN }}
+
+      # Step to set up JDK 11 for running SonarQube scan
+      - name: Setup JDK 11
+        id: setup-java-11
+        uses: actions/setup-java@v2
+        with:
+          distribution: adopt
+          java-version: 11
+
+      # Use JDK 11 for SonarQube analysis
       - name: Run SonarScanner
-        run: ./gradlew build sonarqube -x test -Dsonar.verbose=true -Dsonar.projectKey=conductor -Dsonar.host.url=https://sonarqube.dmlib.de -Dsonar.login=${{ secrets.DELUXE_ORG_SONAR_TOKEN }}
+        run: JAVA_HOME="${{ steps.setup-java-11.outputs.path }}" ./gradlew sonarqube -x test -Dsonar.verbose=true -Dsonar.projectKey=conductor -Dsonar.host.url=https://sonarqube.dmlib.de -Dsonar.login=${{ secrets.DELUXE_ORG_SONAR_TOKEN }}
+        env:
+          GIT_USER: ${{ secrets.AM_GPR_USER }}
+          GIT_TOKEN: ${{ secrets.DELUXE_ORG_GPR_TOKEN }}

archiver/build.gradle

@@ -1,13 +1,14 @@
 plugins {
     id 'de.sebastianboegl.shadow.transformer.log4j' version '2.1.1'
-    id 'com.github.johnrengelman.shadow' version '1.2.4'
+    id 'com.github.johnrengelman.shadow' version '5.0.0' // Updated for Gradle 5 compatibility
     id 'application'
     id 'java'
 }
 
 mainClassName = "com.netflix.conductor.archiver.Main"
 
-sourceCompatibility = 1.8
+sourceCompatibility = '1.8'
+targetCompatibility = '1.8'
 
 repositories {
     mavenCentral()
@@ -24,28 +25,29 @@ dependencies {
     }
 
     // Log4j
-//    compile 'org.apache.logging.log4j:log4j-core:2.11.1'
-    compile 'org.apache.logging.log4j:log4j-slf4j-impl:2.17.0'
+    implementation 'org.apache.logging.log4j:log4j-slf4j-impl:2.17.0'
 
     // PostgreSQL
-    compile group: 'org.postgresql', name: 'postgresql', version: '42.4.0'
-    compile group: 'com.zaxxer', name: 'HikariCP', version: '4.0.3'
+    implementation group: 'org.postgresql', name: 'postgresql', version: '42.4.0'
+    implementation group: 'com.zaxxer', name: 'HikariCP', version: '4.0.3'
 
     // Tools
-    compile group: 'org.apache.commons', name: 'commons-lang3', version: '3.2.1'
-    compile group: 'org.apache.commons', name: 'commons-configuration2', version: '2.2'
-    compile group: 'commons-beanutils', name: 'commons-beanutils', version: '1.9.3'
-    compile group: 'com.google.guava', name: 'guava', version: '19.0'
-    compile group: 'commons-io', name: 'commons-io', version: '2.6'
-    compile group: 'joda-time', name: 'joda-time', version: '2.9.9'
+    implementation group: 'org.apache.commons', name: 'commons-lang3', version: '3.2.1'
+    implementation group: 'org.apache.commons', name: 'commons-configuration2', version: '2.2'
+    implementation group: 'commons-beanutils', name: 'commons-beanutils', version: '1.9.3'
+    implementation group: 'com.google.guava', name: 'guava', version: '19.0'
+    implementation group: 'commons-io', name: 'commons-io', version: '2.6'
+    implementation group: 'joda-time', name: 'joda-time', version: '2.9.9'
 }
 
 shadowJar {
-    configurations = [project.configurations.compile]
+    configurations = [project.configurations.runtimeClasspath] // Use `runtimeClasspath` for Gradle 5 compatibility
     manifest {
-        attributes 'Description': 'Self contained conductor archiver jar'
-        attributes 'Main-Class': 'com.netflix.conductor.archiver.Main'
+        attributes(
+                'Description': 'Self-contained conductor archiver jar',
+                'Main-Class': 'com.netflix.conductor.archiver.Main'
+        )
     }
 }
 
-build.dependsOn('shadowJar')
+build.dependsOn('shadowJar')

build.gradle

@@ -1,16 +1,16 @@
 buildscript {
-
-	repositories {
+    repositories {
         mavenCentral()
         maven { url "https://repo.grails.org/grails/core/" }
     }
-    
+
     dependencies {
         classpath 'com.netflix.nebula:gradle-extra-configurations-plugin:3.0.3'
-        classpath 'org.sonarsource.scanner.gradle:sonarqube-gradle-plugin:2.8'
+        classpath 'org.sonarsource.scanner.gradle:sonarqube-gradle-plugin:3.1.1'
         classpath 'org.apache.ant:ant:1.9.7'
     }
 }
+
 plugins {
     id 'nebula.netflixoss' version '5.1.1'
 }
@@ -20,6 +20,7 @@ ext.githubProjectName = rootProject.name // Change if github project name is not
 
 apply plugin: 'project-report'
 apply plugin: 'org.sonarqube'
+apply plugin: 'jacoco'
 
 subprojects {
 
@@ -29,9 +30,10 @@ subprojects {
     apply plugin: 'idea'
     apply plugin: 'eclipse'
     apply plugin: 'project-report'
+    apply plugin: 'jacoco'
 
-    sourceCompatibility = 1.8
-    targetCompatibility = 1.8
+    sourceCompatibility = '1.8'
+    targetCompatibility = '1.8'
 
     repositories {
         mavenCentral()
@@ -47,23 +49,47 @@ subprojects {
     }
 
     dependencies {
-    	testCompile 'junit:junit-dep:4.10'
-    	testCompile 'org.mockito:mockito-all:1.10.19'
+        testImplementation 'junit:junit-dep:4.10'
+        testImplementation 'org.mockito:mockito-all:1.10.19'
     }
 
     group = "com.netflix.${githubProjectName}"
-    
-    tasks.withType(Test)  {
+
+    tasks.withType(Test) {
         maxParallelForks = 100
+        finalizedBy jacocoTestReport // Ensure JaCoCo runs after tests
+    }
+
+    jacocoTestReport {
+        dependsOn test // Run tests before generating the report
+        reports {
+            xml.enabled = true  // Required for SonarQube
+            html.enabled = true // Optional, for easier local inspection
+        }
     }
-    
+
     license {
-		excludes(['**/*.txt', '**/*.conf', '**/*.properties', '**/*.json', '**/swagger-ui/*'])
-	}
-
-	task licenseFormatTests (type:nl.javadude.gradle.plugins.license.License) {
-    	source = fileTree(dir: "src/test").include("**/*")
-	}
-	licenseFormat.dependsOn licenseFormatTests
+        excludes(['**/*.txt', '**/*.conf', '**/*.properties', '**/*.json', '**/swagger-ui/*'])
+    }
 
+    task licenseFormatTests(type: nl.javadude.gradle.plugins.license.License) {
+        source = fileTree(dir: "src/test").include("**/*")
+    }
+    licenseFormat.dependsOn licenseFormatTests
 }
+
+sonarqube {
+    properties {
+        property "sonar.coverage.jacoco.xmlReportPaths",
+                "archiver/build/reports/jacoco/test/jacocoTestReport.xml," +
+                "client/build/reports/jacoco/test/jacocoTestReport.xml," +
+                "common/build/reports/jacoco/test/jacocoTestReport.xml," +
+                "contribs/build/reports/jacoco/test/jacocoTestReport.xml," +
+                "core/build/reports/jacoco/test/jacocoTestReport.xml," +
+                "correlation/build/reports/jacoco/test/jacocoTestReport.xml," +
+                "postgresql-persistence/build/reports/jacoco/test/jacocoTestReport.xml," +
+                "redis-persistence/build/reports/jacoco/test/jacocoTestReport.xml," +
+                "server/build/reports/jacoco/test/jacocoTestReport.xml," +
+                "ui/build/reports/jacoco/test/jacocoTestReport.xml"
+    }
+}

client/build.gradle

@@ -1,12 +1,15 @@
 dependencies {
+	// Project dependencies
+	implementation project(':conductor-common')
 
-	compile project (':conductor-common')
-	compile 'com.sun.jersey:jersey-client:1.19.4'
-	compile 'org.slf4j:slf4j-api:1.7.28'
-	compile 'com.netflix.spectator:spectator-api:0.68.0'
-	compile 'com.netflix.eureka:eureka-client:latest.release'
-	compile ('com.fasterxml.jackson.jaxrs:jackson-jaxrs-json-provider:2.7.5') {force=true}
-	compile 'com.netflix.archaius:archaius-core:0.7.5' 
-
-	testCompile 'org.slf4j:slf4j-log4j12:1.8.0-alpha1'
+	// External dependencies
+	implementation 'com.sun.jersey:jersey-client:1.19.4'
+	implementation 'org.slf4j:slf4j-api:1.7.28'
+	implementation 'com.netflix.spectator:spectator-api:0.68.0'
+	implementation 'com.netflix.eureka:eureka-client:latest.release'
+	implementation('com.fasterxml.jackson.jaxrs:jackson-jaxrs-json-provider:2.7.5') { force = true }
+	implementation 'com.netflix.archaius:archaius-core:0.7.5'
+
+	// Test dependencies
+	testImplementation 'org.slf4j:slf4j-log4j12:1.8.0-alpha1'
 }

common/build.gradle

@@ -1,3 +1,3 @@
 dependencies {
-    compile group: 'org.postgresql', name: 'postgresql', version: '42.4.0'
+    implementation group: 'org.postgresql', name: 'postgresql', version: '42.4.0'
 }

contribs/build.gradle

@@ -1,35 +1,39 @@
 dependencies {
-	compile project(':conductor-correlation')
-	compile project(':conductor-common')
-	compile project(':conductor-core')
+	// Project dependencies
+	implementation project(':conductor-correlation')
+	implementation project(':conductor-common')
+	implementation project(':conductor-core')
 
-	compile 'com.amazonaws:aws-java-sdk-sqs:1.12.428'
-	compile ('com.google.inject:guice:4.1.0') { force= true}
+	// External dependencies
+	implementation 'com.amazonaws:aws-java-sdk-sqs:1.12.428'
+	implementation('com.google.inject:guice:4.1.0') { force = true }
 
-	compile 'net.thisptr:jackson-jq:0.0.13'
+	implementation 'net.thisptr:jackson-jq:0.0.13'
 
-	compile 'com.sun.jersey:jersey-bundle:1.18.6'
-	compile 'com.sun.jersey.contribs.jersey-oauth:oauth-client:1.19.4'
-	compile 'com.sun.jersey.contribs.jersey-oauth:oauth-signature:1.19.4'
-	compile group: 'org.json', name: 'json', version: '20141113'
-	compile group: 'io.nats', name: 'jnats', version: '2.0.0'
-	compile (group: 'io.nats', name: 'java-nats-streaming', version: '2.2.0') {
+	implementation 'com.sun.jersey:jersey-bundle:1.18.6'
+	implementation 'com.sun.jersey.contribs.jersey-oauth:oauth-client:1.19.4'
+	implementation 'com.sun.jersey.contribs.jersey-oauth:oauth-signature:1.19.4'
+	implementation group: 'org.json', name: 'json', version: '20141113'
+	implementation group: 'io.nats', name: 'jnats', version: '2.0.0'
+	implementation(group: 'io.nats', name: 'java-nats-streaming', version: '2.2.0') {
 		exclude group: 'io.nats', module: 'jnats'
 	}
 
-	compile files('libs/one-mq-0.3.12.jar')
-	compile 'io.grpc:grpc-core:1.15.1'
-	compile 'io.grpc:grpc-netty-shaded:1.15.1'
-	compile 'io.grpc:grpc-protobuf:1.15.1'
-	compile 'io.grpc:grpc-stub:1.15.1'
-	compile 'io.grpc:protoc-gen-grpc-java:1.15.1'
+	implementation files('libs/one-mq-0.3.12.jar')
+	implementation 'io.grpc:grpc-core:1.15.1'
+	implementation 'io.grpc:grpc-netty-shaded:1.15.1'
+	implementation 'io.grpc:grpc-protobuf:1.15.1'
+	implementation 'io.grpc:grpc-stub:1.15.1'
+	implementation 'io.grpc:protoc-gen-grpc-java:1.15.1'
 
-	compile 'com.datadoghq:dd-trace-api:0.88.0'
+	implementation 'com.datadoghq:dd-trace-api:0.88.0'
 
+	// Provided dependencies
 	provided 'javax.ws.rs:jsr311-api:1.1.1'
 	provided 'io.swagger:swagger-jaxrs:1.5.9'
 	provided 'log4j:log4j:1.2.17'
 
-	testCompile 'org.eclipse.jetty:jetty-server:9.3.9.v20160517'
-	testCompile 'org.eclipse.jetty:jetty-servlet:9.3.9.v20160517'
-}
+	// Test dependencies
+	testImplementation 'org.eclipse.jetty:jetty-server:9.3.9.v20160517'
+	testImplementation 'org.eclipse.jetty:jetty-servlet:9.3.9.v20160517'
+}

core/build.gradle

@@ -8,27 +8,32 @@ dependencies {
 		}
 	}
 
-	compile project(':conductor-common')
-	compile project(':conductor-correlation')
+	// Project dependencies
+	implementation project(':conductor-common')
+	implementation project(':conductor-correlation')
 
-	compile 'com.datadoghq:dd-trace-api:0.88.0'
-	compile 'com.datadoghq:java-dogstatsd-client:2.11.0'
-	compile 'io.reactivex:rxjava:1.2.2'
-	compile 'com.google.inject:guice:4.1.0'
-	compile 'com.netflix.spectator:spectator-api:0.68.0'
-	compile 'com.netflix.eureka:eureka-client:latest.release'
-	compile ('com.fasterxml.jackson.core:jackson-databind:2.7.5') {force=true}
-	compile ('com.fasterxml.jackson.core:jackson-core:2.7.5') {force=true}
-	compile 'com.jayway.jsonpath:json-path:2.2.0'
-	compile 'dnsjava:dnsjava:2.1.8'
-	compile 'net.thisptr:jackson-jq:0.0.13'
-	compile 'com.auth0:java-jwt:3.2.0'
-	compile 'commons-collections:commons-collections:3.2.2'
-	compile 'org.apache.commons:commons-lang3:3.2.1'
-	compile 'com.sun.jersey.contribs:jersey-apache-client4:1.19.4'
-	compile 'org.apache.commons:commons-text:1.10.0'
+	// External dependencies
+	implementation 'com.datadoghq:dd-trace-api:0.88.0'
+	implementation 'com.datadoghq:java-dogstatsd-client:2.11.0'
+	implementation 'io.reactivex:rxjava:1.2.2'
+	implementation 'com.google.inject:guice:4.1.0'
+	implementation 'com.netflix.spectator:spectator-api:0.68.0'
+	implementation 'com.netflix.eureka:eureka-client:latest.release'
+	implementation ('com.fasterxml.jackson.core:jackson-databind:2.7.5') { force = true }
+	implementation ('com.fasterxml.jackson.core:jackson-core:2.7.5') { force = true }
+	implementation 'com.jayway.jsonpath:json-path:2.2.0'
+	implementation 'dnsjava:dnsjava:2.1.8'
+	implementation 'net.thisptr:jackson-jq:0.0.13'
+	implementation 'com.auth0:java-jwt:3.2.0'
+	implementation 'commons-collections:commons-collections:3.2.2'
+	implementation 'org.apache.commons:commons-lang3:3.2.1'
+	implementation 'com.sun.jersey.contribs:jersey-apache-client4:1.19.4'
+	implementation 'org.apache.commons:commons-text:1.10.0'
+
+	// Provided dependencies (using `provided` or `compileOnly` depending on the plugin used)
 	provided 'log4j:log4j:1.2.17'
 
-	testCompile 'org.eclipse.jetty:jetty-server:9.3.9.v20160517'
-	testCompile 'org.eclipse.jetty:jetty-servlet:9.3.9.v20160517'
+	// Test dependencies
+	testImplementation 'org.eclipse.jetty:jetty-server:9.3.9.v20160517'
+	testImplementation 'org.eclipse.jetty:jetty-servlet:9.3.9.v20160517'
 }

correlation/build.gradle

@@ -1,10 +1,10 @@
 dependencies {
-    compile ('com.fasterxml.jackson.core:jackson-databind:2.7.5') {force=true}
-	compile ('com.fasterxml.jackson.core:jackson-core:2.7.5') {force=true}    
-    compile 'com.sun.jersey:jersey-client:1.19.4'
-    compile 'org.apache.commons:commons-lang3:3.2.1'
-    compile 'org.json:json:20141113'
-	compile 'org.slf4j:slf4j-api:1.7.28'
+    implementation ('com.fasterxml.jackson.core:jackson-databind:2.7.5') {force=true}
+    implementation ('com.fasterxml.jackson.core:jackson-core:2.7.5') {force=true}
+    implementation 'com.sun.jersey:jersey-client:1.19.4'
+    implementation 'org.apache.commons:commons-lang3:3.2.1'
+    implementation 'org.json:json:20141113'
+    implementation 'org.slf4j:slf4j-api:1.7.28'
 
     provided 'log4j:log4j:1.2.17'
 }