diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index 8afc602..6b9e36b 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -7,19 +7,17 @@ jobs: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v3 + - uses: actions/checkout@v4 + with: + fetch-depth: 0 + persist-credentials: false - name: Set up JDK 21 uses: oracle-actions/setup-java@v1 with: website: jdk.java.net release: 21 - - - name: Build with Maven - run: mvn clean install -B - - - name: Mutation testing - run: mvn org.pitest:pitest-maven:mutationCoverage -B + - run: ./mvnw clean install -Pall-quality-gates -B release: runs-on: ubuntu-latest @@ -27,7 +25,10 @@ jobs: if: github.ref == 'refs/heads/main' steps: - - uses: actions/checkout@v3 + - uses: actions/checkout@v4 + with: + fetch-depth: 0 + persist-credentials: false - name: Set up JDK 21 uses: oracle-actions/setup-java@v1 @@ -36,7 +37,7 @@ jobs: release: 21 - name: Determine version - run: echo "POM_VERSION=$(mvn -q -Dexec.executable=echo -Dexec.args='${project.version}' --non-recursive exec:exec | sed -e 's/-SNAPSHOT//')" >> $GITHUB_ENV + run: echo "POM_VERSION=$(./mvnw -q -Dexec.executable=echo -Dexec.args='${project.version}' --non-recursive exec:exec | sed -e 's/-SNAPSHOT//')" >> $GITHUB_ENV - name: Import GPG key id: import_gpg @@ -51,7 +52,7 @@ jobs: git config user.name "GitHub Actions" - name: Create release - run: mvn --settings .github/maven-settings.xml release:prepare release:perform -DskipTests -Prelease -B + run: ./mvnw --settings .github/maven-settings.xml release:prepare release:perform -DskipTests -Prelease -B env: OSSRH_USERNAME: ${{ secrets.OSSRH_USERNAME }} OSSRH_PASSWORD: ${{ secrets.OSSRH_PASSWORD }} @@ -66,4 +67,5 @@ jobs: token: ${{ secrets.GITHUB_TOKEN }} tag: ${{ env.POM_VERSION }} artifacts: spt-development-logging-spring-boot-autoconfigure/target/spt-development-logging-spring-boot-autoconfigure-${{ env.POM_VERSION }}.jar,spt-development-logging-spring-boot-starter/target/spt-development-logging-spring-boot-starter-${{ env.POM_VERSION }}.jar - artifactContentType: application/java-archive \ No newline at end of file + artifactContentType: application/java-archive + bodyFile: documentation/releases/release-${{ env.POM_VERSION }}.md diff --git a/.github/workflows/latest-versions.yml b/.github/workflows/latest-versions.yml new file mode 100644 index 0000000..6f7781a --- /dev/null +++ b/.github/workflows/latest-versions.yml @@ -0,0 +1,17 @@ +name: Latest Versions Check + +on: [pull_request] + +jobs: + versions: + runs-on: ubuntu-latest + + steps: + - uses: actions/checkout@v4 + + - name: Set up JDK 21 + uses: oracle-actions/setup-java@v1 + with: + website: jdk.java.net + release: 21 + - run: ./mvnw clean versions:update-properties scm:check-local-modification -U -B \ No newline at end of file diff --git a/.github/workflows/owasp.yml b/.github/workflows/owasp.yml new file mode 100644 index 0000000..2ae555a --- /dev/null +++ b/.github/workflows/owasp.yml @@ -0,0 +1,17 @@ +name: OWASP Dependency Check + +on: [pull_request] + +jobs: + owasp: + runs-on: ubuntu-latest + + steps: + - uses: actions/checkout@v4 + + - name: Set up JDK 21 + uses: oracle-actions/setup-java@v1 + with: + website: jdk.java.net + release: 21 + - run: ./mvnw clean install dependency-check:check -DskipTests -B \ No newline at end of file diff --git a/.mvn/wrapper/maven-wrapper.properties b/.mvn/wrapper/maven-wrapper.properties new file mode 100644 index 0000000..ac18401 --- /dev/null +++ b/.mvn/wrapper/maven-wrapper.properties @@ -0,0 +1,18 @@ +# Licensed to the Apache Software Foundation (ASF) under one +# or more contributor license agreements. See the NOTICE file +# distributed with this work for additional information +# regarding copyright ownership. The ASF licenses this file +# to you under the Apache License, Version 2.0 (the +# "License"); you may not use this file except in compliance +# with the License. You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, +# software distributed under the License is distributed on an +# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY +# KIND, either express or implied. See the License for the +# specific language governing permissions and limitations +# under the License. +distributionUrl=https://repo.maven.apache.org/maven2/org/apache/maven/apache-maven/3.9.4/apache-maven-3.9.4-bin.zip +wrapperUrl=https://repo.maven.apache.org/maven2/org/apache/maven/wrapper/maven-wrapper/3.2.0/maven-wrapper-3.2.0.jar diff --git a/README.md b/README.md index ba05b58..4a8bc2f 100644 --- a/README.md +++ b/README.md @@ -34,7 +34,7 @@ Building locally To build the library, run the following maven command: ```shell -$ mvn clean install +$ ./mvnw clean install ``` Release diff --git a/maven-version-rules.xml b/config/versions/version-rules.xml similarity index 100% rename from maven-version-rules.xml rename to config/versions/version-rules.xml diff --git a/documentation/releases/release-3.1.5.md b/documentation/releases/release-3.1.5.md new file mode 100644 index 0000000..5d792b7 --- /dev/null +++ b/documentation/releases/release-3.1.5.md @@ -0,0 +1,7 @@ +## General + +* Added additional quality gates to build. + +## Dependencies + +* Aligned dependencies with Spring Boot 3.1.5 \ No newline at end of file diff --git a/mvnw b/mvnw new file mode 100755 index 0000000..8d937f4 --- /dev/null +++ b/mvnw @@ -0,0 +1,308 @@ +#!/bin/sh +# ---------------------------------------------------------------------------- +# Licensed to the Apache Software Foundation (ASF) under one +# or more contributor license agreements. See the NOTICE file +# distributed with this work for additional information +# regarding copyright ownership. The ASF licenses this file +# to you under the Apache License, Version 2.0 (the +# "License"); you may not use this file except in compliance +# with the License. You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, +# software distributed under the License is distributed on an +# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY +# KIND, either express or implied. See the License for the +# specific language governing permissions and limitations +# under the License. +# ---------------------------------------------------------------------------- + +# ---------------------------------------------------------------------------- +# Apache Maven Wrapper startup batch script, version 3.2.0 +# +# Required ENV vars: +# ------------------ +# JAVA_HOME - location of a JDK home dir +# +# Optional ENV vars +# ----------------- +# MAVEN_OPTS - parameters passed to the Java VM when running Maven +# e.g. to debug Maven itself, use +# set MAVEN_OPTS=-Xdebug -Xrunjdwp:transport=dt_socket,server=y,suspend=y,address=8000 +# MAVEN_SKIP_RC - flag to disable loading of mavenrc files +# ---------------------------------------------------------------------------- + +if [ -z "$MAVEN_SKIP_RC" ] ; then + + if [ -f /usr/local/etc/mavenrc ] ; then + . /usr/local/etc/mavenrc + fi + + if [ -f /etc/mavenrc ] ; then + . /etc/mavenrc + fi + + if [ -f "$HOME/.mavenrc" ] ; then + . "$HOME/.mavenrc" + fi + +fi + +# OS specific support. $var _must_ be set to either true or false. +cygwin=false; +darwin=false; +mingw=false +case "$(uname)" in + CYGWIN*) cygwin=true ;; + MINGW*) mingw=true;; + Darwin*) darwin=true + # Use /usr/libexec/java_home if available, otherwise fall back to /Library/Java/Home + # See https://developer.apple.com/library/mac/qa/qa1170/_index.html + if [ -z "$JAVA_HOME" ]; then + if [ -x "/usr/libexec/java_home" ]; then + JAVA_HOME="$(/usr/libexec/java_home)"; export JAVA_HOME + else + JAVA_HOME="/Library/Java/Home"; export JAVA_HOME + fi + fi + ;; +esac + +if [ -z "$JAVA_HOME" ] ; then + if [ -r /etc/gentoo-release ] ; then + JAVA_HOME=$(java-config --jre-home) + fi +fi + +# For Cygwin, ensure paths are in UNIX format before anything is touched +if $cygwin ; then + [ -n "$JAVA_HOME" ] && + JAVA_HOME=$(cygpath --unix "$JAVA_HOME") + [ -n "$CLASSPATH" ] && + CLASSPATH=$(cygpath --path --unix "$CLASSPATH") +fi + +# For Mingw, ensure paths are in UNIX format before anything is touched +if $mingw ; then + [ -n "$JAVA_HOME" ] && [ -d "$JAVA_HOME" ] && + JAVA_HOME="$(cd "$JAVA_HOME" || (echo "cannot cd into $JAVA_HOME."; exit 1); pwd)" +fi + +if [ -z "$JAVA_HOME" ]; then + javaExecutable="$(which javac)" + if [ -n "$javaExecutable" ] && ! [ "$(expr "\"$javaExecutable\"" : '\([^ ]*\)')" = "no" ]; then + # readlink(1) is not available as standard on Solaris 10. + readLink=$(which readlink) + if [ ! "$(expr "$readLink" : '\([^ ]*\)')" = "no" ]; then + if $darwin ; then + javaHome="$(dirname "\"$javaExecutable\"")" + javaExecutable="$(cd "\"$javaHome\"" && pwd -P)/javac" + else + javaExecutable="$(readlink -f "\"$javaExecutable\"")" + fi + javaHome="$(dirname "\"$javaExecutable\"")" + javaHome=$(expr "$javaHome" : '\(.*\)/bin') + JAVA_HOME="$javaHome" + export JAVA_HOME + fi + fi +fi + +if [ -z "$JAVACMD" ] ; then + if [ -n "$JAVA_HOME" ] ; then + if [ -x "$JAVA_HOME/jre/sh/java" ] ; then + # IBM's JDK on AIX uses strange locations for the executables + JAVACMD="$JAVA_HOME/jre/sh/java" + else + JAVACMD="$JAVA_HOME/bin/java" + fi + else + JAVACMD="$(\unset -f command 2>/dev/null; \command -v java)" + fi +fi + +if [ ! -x "$JAVACMD" ] ; then + echo "Error: JAVA_HOME is not defined correctly." >&2 + echo " We cannot execute $JAVACMD" >&2 + exit 1 +fi + +if [ -z "$JAVA_HOME" ] ; then + echo "Warning: JAVA_HOME environment variable is not set." +fi + +# traverses directory structure from process work directory to filesystem root +# first directory with .mvn subdirectory is considered project base directory +find_maven_basedir() { + if [ -z "$1" ] + then + echo "Path not specified to find_maven_basedir" + return 1 + fi + + basedir="$1" + wdir="$1" + while [ "$wdir" != '/' ] ; do + if [ -d "$wdir"/.mvn ] ; then + basedir=$wdir + break + fi + # workaround for JBEAP-8937 (on Solaris 10/Sparc) + if [ -d "${wdir}" ]; then + wdir=$(cd "$wdir/.." || exit 1; pwd) + fi + # end of workaround + done + printf '%s' "$(cd "$basedir" || exit 1; pwd)" +} + +# concatenates all lines of a file +concat_lines() { + if [ -f "$1" ]; then + # Remove \r in case we run on Windows within Git Bash + # and check out the repository with auto CRLF management + # enabled. Otherwise, we may read lines that are delimited with + # \r\n and produce $'-Xarg\r' rather than -Xarg due to word + # splitting rules. + tr -s '\r\n' ' ' < "$1" + fi +} + +log() { + if [ "$MVNW_VERBOSE" = true ]; then + printf '%s\n' "$1" + fi +} + +BASE_DIR=$(find_maven_basedir "$(dirname "$0")") +if [ -z "$BASE_DIR" ]; then + exit 1; +fi + +MAVEN_PROJECTBASEDIR=${MAVEN_BASEDIR:-"$BASE_DIR"}; export MAVEN_PROJECTBASEDIR +log "$MAVEN_PROJECTBASEDIR" + +########################################################################################## +# Extension to allow automatically downloading the maven-wrapper.jar from Maven-central +# This allows using the maven wrapper in projects that prohibit checking in binary data. +########################################################################################## +wrapperJarPath="$MAVEN_PROJECTBASEDIR/.mvn/wrapper/maven-wrapper.jar" +if [ -r "$wrapperJarPath" ]; then + log "Found $wrapperJarPath" +else + log "Couldn't find $wrapperJarPath, downloading it ..." + + if [ -n "$MVNW_REPOURL" ]; then + wrapperUrl="$MVNW_REPOURL/org/apache/maven/wrapper/maven-wrapper/3.2.0/maven-wrapper-3.2.0.jar" + else + wrapperUrl="https://repo.maven.apache.org/maven2/org/apache/maven/wrapper/maven-wrapper/3.2.0/maven-wrapper-3.2.0.jar" + fi + while IFS="=" read -r key value; do + # Remove '\r' from value to allow usage on windows as IFS does not consider '\r' as a separator ( considers space, tab, new line ('\n'), and custom '=' ) + safeValue=$(echo "$value" | tr -d '\r') + case "$key" in (wrapperUrl) wrapperUrl="$safeValue"; break ;; + esac + done < "$MAVEN_PROJECTBASEDIR/.mvn/wrapper/maven-wrapper.properties" + log "Downloading from: $wrapperUrl" + + if $cygwin; then + wrapperJarPath=$(cygpath --path --windows "$wrapperJarPath") + fi + + if command -v wget > /dev/null; then + log "Found wget ... using wget" + [ "$MVNW_VERBOSE" = true ] && QUIET="" || QUIET="--quiet" + if [ -z "$MVNW_USERNAME" ] || [ -z "$MVNW_PASSWORD" ]; then + wget $QUIET "$wrapperUrl" -O "$wrapperJarPath" || rm -f "$wrapperJarPath" + else + wget $QUIET --http-user="$MVNW_USERNAME" --http-password="$MVNW_PASSWORD" "$wrapperUrl" -O "$wrapperJarPath" || rm -f "$wrapperJarPath" + fi + elif command -v curl > /dev/null; then + log "Found curl ... using curl" + [ "$MVNW_VERBOSE" = true ] && QUIET="" || QUIET="--silent" + if [ -z "$MVNW_USERNAME" ] || [ -z "$MVNW_PASSWORD" ]; then + curl $QUIET -o "$wrapperJarPath" "$wrapperUrl" -f -L || rm -f "$wrapperJarPath" + else + curl $QUIET --user "$MVNW_USERNAME:$MVNW_PASSWORD" -o "$wrapperJarPath" "$wrapperUrl" -f -L || rm -f "$wrapperJarPath" + fi + else + log "Falling back to using Java to download" + javaSource="$MAVEN_PROJECTBASEDIR/.mvn/wrapper/MavenWrapperDownloader.java" + javaClass="$MAVEN_PROJECTBASEDIR/.mvn/wrapper/MavenWrapperDownloader.class" + # For Cygwin, switch paths to Windows format before running javac + if $cygwin; then + javaSource=$(cygpath --path --windows "$javaSource") + javaClass=$(cygpath --path --windows "$javaClass") + fi + if [ -e "$javaSource" ]; then + if [ ! -e "$javaClass" ]; then + log " - Compiling MavenWrapperDownloader.java ..." + ("$JAVA_HOME/bin/javac" "$javaSource") + fi + if [ -e "$javaClass" ]; then + log " - Running MavenWrapperDownloader.java ..." + ("$JAVA_HOME/bin/java" -cp .mvn/wrapper MavenWrapperDownloader "$wrapperUrl" "$wrapperJarPath") || rm -f "$wrapperJarPath" + fi + fi + fi +fi +########################################################################################## +# End of extension +########################################################################################## + +# If specified, validate the SHA-256 sum of the Maven wrapper jar file +wrapperSha256Sum="" +while IFS="=" read -r key value; do + case "$key" in (wrapperSha256Sum) wrapperSha256Sum=$value; break ;; + esac +done < "$MAVEN_PROJECTBASEDIR/.mvn/wrapper/maven-wrapper.properties" +if [ -n "$wrapperSha256Sum" ]; then + wrapperSha256Result=false + if command -v sha256sum > /dev/null; then + if echo "$wrapperSha256Sum $wrapperJarPath" | sha256sum -c > /dev/null 2>&1; then + wrapperSha256Result=true + fi + elif command -v shasum > /dev/null; then + if echo "$wrapperSha256Sum $wrapperJarPath" | shasum -a 256 -c > /dev/null 2>&1; then + wrapperSha256Result=true + fi + else + echo "Checksum validation was requested but neither 'sha256sum' or 'shasum' are available." + echo "Please install either command, or disable validation by removing 'wrapperSha256Sum' from your maven-wrapper.properties." + exit 1 + fi + if [ $wrapperSha256Result = false ]; then + echo "Error: Failed to validate Maven wrapper SHA-256, your Maven wrapper might be compromised." >&2 + echo "Investigate or delete $wrapperJarPath to attempt a clean download." >&2 + echo "If you updated your Maven version, you need to update the specified wrapperSha256Sum property." >&2 + exit 1 + fi +fi + +MAVEN_OPTS="$(concat_lines "$MAVEN_PROJECTBASEDIR/.mvn/jvm.config") $MAVEN_OPTS" + +# For Cygwin, switch paths to Windows format before running java +if $cygwin; then + [ -n "$JAVA_HOME" ] && + JAVA_HOME=$(cygpath --path --windows "$JAVA_HOME") + [ -n "$CLASSPATH" ] && + CLASSPATH=$(cygpath --path --windows "$CLASSPATH") + [ -n "$MAVEN_PROJECTBASEDIR" ] && + MAVEN_PROJECTBASEDIR=$(cygpath --path --windows "$MAVEN_PROJECTBASEDIR") +fi + +# Provide a "standardized" way to retrieve the CLI args that will +# work with both Windows and non-Windows executions. +MAVEN_CMD_LINE_ARGS="$MAVEN_CONFIG $*" +export MAVEN_CMD_LINE_ARGS + +WRAPPER_LAUNCHER=org.apache.maven.wrapper.MavenWrapperMain + +# shellcheck disable=SC2086 # safe args +exec "$JAVACMD" \ + $MAVEN_OPTS \ + $MAVEN_DEBUG_OPTS \ + -classpath "$MAVEN_PROJECTBASEDIR/.mvn/wrapper/maven-wrapper.jar" \ + "-Dmaven.multiModuleProjectDirectory=${MAVEN_PROJECTBASEDIR}" \ + ${WRAPPER_LAUNCHER} $MAVEN_CONFIG "$@" diff --git a/mvnw.cmd b/mvnw.cmd new file mode 100644 index 0000000..f80fbad --- /dev/null +++ b/mvnw.cmd @@ -0,0 +1,205 @@ +@REM ---------------------------------------------------------------------------- +@REM Licensed to the Apache Software Foundation (ASF) under one +@REM or more contributor license agreements. See the NOTICE file +@REM distributed with this work for additional information +@REM regarding copyright ownership. The ASF licenses this file +@REM to you under the Apache License, Version 2.0 (the +@REM "License"); you may not use this file except in compliance +@REM with the License. You may obtain a copy of the License at +@REM +@REM http://www.apache.org/licenses/LICENSE-2.0 +@REM +@REM Unless required by applicable law or agreed to in writing, +@REM software distributed under the License is distributed on an +@REM "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY +@REM KIND, either express or implied. See the License for the +@REM specific language governing permissions and limitations +@REM under the License. +@REM ---------------------------------------------------------------------------- + +@REM ---------------------------------------------------------------------------- +@REM Apache Maven Wrapper startup batch script, version 3.2.0 +@REM +@REM Required ENV vars: +@REM JAVA_HOME - location of a JDK home dir +@REM +@REM Optional ENV vars +@REM MAVEN_BATCH_ECHO - set to 'on' to enable the echoing of the batch commands +@REM MAVEN_BATCH_PAUSE - set to 'on' to wait for a keystroke before ending +@REM MAVEN_OPTS - parameters passed to the Java VM when running Maven +@REM e.g. to debug Maven itself, use +@REM set MAVEN_OPTS=-Xdebug -Xrunjdwp:transport=dt_socket,server=y,suspend=y,address=8000 +@REM MAVEN_SKIP_RC - flag to disable loading of mavenrc files +@REM ---------------------------------------------------------------------------- + +@REM Begin all REM lines with '@' in case MAVEN_BATCH_ECHO is 'on' +@echo off +@REM set title of command window +title %0 +@REM enable echoing by setting MAVEN_BATCH_ECHO to 'on' +@if "%MAVEN_BATCH_ECHO%" == "on" echo %MAVEN_BATCH_ECHO% + +@REM set %HOME% to equivalent of $HOME +if "%HOME%" == "" (set "HOME=%HOMEDRIVE%%HOMEPATH%") + +@REM Execute a user defined script before this one +if not "%MAVEN_SKIP_RC%" == "" goto skipRcPre +@REM check for pre script, once with legacy .bat ending and once with .cmd ending +if exist "%USERPROFILE%\mavenrc_pre.bat" call "%USERPROFILE%\mavenrc_pre.bat" %* +if exist "%USERPROFILE%\mavenrc_pre.cmd" call "%USERPROFILE%\mavenrc_pre.cmd" %* +:skipRcPre + +@setlocal + +set ERROR_CODE=0 + +@REM To isolate internal variables from possible post scripts, we use another setlocal +@setlocal + +@REM ==== START VALIDATION ==== +if not "%JAVA_HOME%" == "" goto OkJHome + +echo. +echo Error: JAVA_HOME not found in your environment. >&2 +echo Please set the JAVA_HOME variable in your environment to match the >&2 +echo location of your Java installation. >&2 +echo. +goto error + +:OkJHome +if exist "%JAVA_HOME%\bin\java.exe" goto init + +echo. +echo Error: JAVA_HOME is set to an invalid directory. >&2 +echo JAVA_HOME = "%JAVA_HOME%" >&2 +echo Please set the JAVA_HOME variable in your environment to match the >&2 +echo location of your Java installation. >&2 +echo. +goto error + +@REM ==== END VALIDATION ==== + +:init + +@REM Find the project base dir, i.e. the directory that contains the folder ".mvn". +@REM Fallback to current working directory if not found. + +set MAVEN_PROJECTBASEDIR=%MAVEN_BASEDIR% +IF NOT "%MAVEN_PROJECTBASEDIR%"=="" goto endDetectBaseDir + +set EXEC_DIR=%CD% +set WDIR=%EXEC_DIR% +:findBaseDir +IF EXIST "%WDIR%"\.mvn goto baseDirFound +cd .. +IF "%WDIR%"=="%CD%" goto baseDirNotFound +set WDIR=%CD% +goto findBaseDir + +:baseDirFound +set MAVEN_PROJECTBASEDIR=%WDIR% +cd "%EXEC_DIR%" +goto endDetectBaseDir + +:baseDirNotFound +set MAVEN_PROJECTBASEDIR=%EXEC_DIR% +cd "%EXEC_DIR%" + +:endDetectBaseDir + +IF NOT EXIST "%MAVEN_PROJECTBASEDIR%\.mvn\jvm.config" goto endReadAdditionalConfig + +@setlocal EnableExtensions EnableDelayedExpansion +for /F "usebackq delims=" %%a in ("%MAVEN_PROJECTBASEDIR%\.mvn\jvm.config") do set JVM_CONFIG_MAVEN_PROPS=!JVM_CONFIG_MAVEN_PROPS! %%a +@endlocal & set JVM_CONFIG_MAVEN_PROPS=%JVM_CONFIG_MAVEN_PROPS% + +:endReadAdditionalConfig + +SET MAVEN_JAVA_EXE="%JAVA_HOME%\bin\java.exe" +set WRAPPER_JAR="%MAVEN_PROJECTBASEDIR%\.mvn\wrapper\maven-wrapper.jar" +set WRAPPER_LAUNCHER=org.apache.maven.wrapper.MavenWrapperMain + +set WRAPPER_URL="https://repo.maven.apache.org/maven2/org/apache/maven/wrapper/maven-wrapper/3.2.0/maven-wrapper-3.2.0.jar" + +FOR /F "usebackq tokens=1,2 delims==" %%A IN ("%MAVEN_PROJECTBASEDIR%\.mvn\wrapper\maven-wrapper.properties") DO ( + IF "%%A"=="wrapperUrl" SET WRAPPER_URL=%%B +) + +@REM Extension to allow automatically downloading the maven-wrapper.jar from Maven-central +@REM This allows using the maven wrapper in projects that prohibit checking in binary data. +if exist %WRAPPER_JAR% ( + if "%MVNW_VERBOSE%" == "true" ( + echo Found %WRAPPER_JAR% + ) +) else ( + if not "%MVNW_REPOURL%" == "" ( + SET WRAPPER_URL="%MVNW_REPOURL%/org/apache/maven/wrapper/maven-wrapper/3.2.0/maven-wrapper-3.2.0.jar" + ) + if "%MVNW_VERBOSE%" == "true" ( + echo Couldn't find %WRAPPER_JAR%, downloading it ... + echo Downloading from: %WRAPPER_URL% + ) + + powershell -Command "&{"^ + "$webclient = new-object System.Net.WebClient;"^ + "if (-not ([string]::IsNullOrEmpty('%MVNW_USERNAME%') -and [string]::IsNullOrEmpty('%MVNW_PASSWORD%'))) {"^ + "$webclient.Credentials = new-object System.Net.NetworkCredential('%MVNW_USERNAME%', '%MVNW_PASSWORD%');"^ + "}"^ + "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; $webclient.DownloadFile('%WRAPPER_URL%', '%WRAPPER_JAR%')"^ + "}" + if "%MVNW_VERBOSE%" == "true" ( + echo Finished downloading %WRAPPER_JAR% + ) +) +@REM End of extension + +@REM If specified, validate the SHA-256 sum of the Maven wrapper jar file +SET WRAPPER_SHA_256_SUM="" +FOR /F "usebackq tokens=1,2 delims==" %%A IN ("%MAVEN_PROJECTBASEDIR%\.mvn\wrapper\maven-wrapper.properties") DO ( + IF "%%A"=="wrapperSha256Sum" SET WRAPPER_SHA_256_SUM=%%B +) +IF NOT %WRAPPER_SHA_256_SUM%=="" ( + powershell -Command "&{"^ + "$hash = (Get-FileHash \"%WRAPPER_JAR%\" -Algorithm SHA256).Hash.ToLower();"^ + "If('%WRAPPER_SHA_256_SUM%' -ne $hash){"^ + " Write-Output 'Error: Failed to validate Maven wrapper SHA-256, your Maven wrapper might be compromised.';"^ + " Write-Output 'Investigate or delete %WRAPPER_JAR% to attempt a clean download.';"^ + " Write-Output 'If you updated your Maven version, you need to update the specified wrapperSha256Sum property.';"^ + " exit 1;"^ + "}"^ + "}" + if ERRORLEVEL 1 goto error +) + +@REM Provide a "standardized" way to retrieve the CLI args that will +@REM work with both Windows and non-Windows executions. +set MAVEN_CMD_LINE_ARGS=%* + +%MAVEN_JAVA_EXE% ^ + %JVM_CONFIG_MAVEN_PROPS% ^ + %MAVEN_OPTS% ^ + %MAVEN_DEBUG_OPTS% ^ + -classpath %WRAPPER_JAR% ^ + "-Dmaven.multiModuleProjectDirectory=%MAVEN_PROJECTBASEDIR%" ^ + %WRAPPER_LAUNCHER% %MAVEN_CONFIG% %* +if ERRORLEVEL 1 goto error +goto end + +:error +set ERROR_CODE=1 + +:end +@endlocal & set ERROR_CODE=%ERROR_CODE% + +if not "%MAVEN_SKIP_RC%"=="" goto skipRcPost +@REM check for post script, once with legacy .bat ending and once with .cmd ending +if exist "%USERPROFILE%\mavenrc_post.bat" call "%USERPROFILE%\mavenrc_post.bat" +if exist "%USERPROFILE%\mavenrc_post.cmd" call "%USERPROFILE%\mavenrc_post.cmd" +:skipRcPost + +@REM pause the script if MAVEN_BATCH_PAUSE is set to 'on' +if "%MAVEN_BATCH_PAUSE%"=="on" pause + +if "%MAVEN_TERMINATE_CMD%"=="on" exit %ERROR_CODE% + +cmd /C exit /B %ERROR_CODE% diff --git a/pom.xml b/pom.xml index 3c03055..6ccb5ac 100644 --- a/pom.xml +++ b/pom.xml @@ -36,33 +36,40 @@ 17 + + 3.9.4 + - 3.1.4 - 2.0.11 - 3.0.10 + 3.1.5 + 2.0.12 + 3.0.11 + 3.4.0 3.3.0 + 8.4.1 1.5.0 1.12.0 - 0.8.10 + 0.8.11 + 2.2.0 3.11.0 3.6.0 3.4.1 - 1.6 - 3.2.0 + 3.1.0 + 3.6.0 + 3.3.0 + 3.21.0 3.0.1 - 3.2.1 + 2.0.1 + 3.3.0 3.1.2 1.6.13 - 1.15.0 + 1.15.1 4.7.3.6 2.16.1 - 9.5 - 10.12.3 - 1.13.2 + 10.12.4 1.2.0 @@ -94,6 +101,45 @@ + + maven-checkstyle-plugin + ${checkstyle-maven-plugin.version} + + + com.puppycrawl.tools + checkstyle + ${checkstyle.version} + + + + true + true + warning + + + + google-checks + validate + + check + + + google_checks.xml + config/checkstyle/google_checks_suppressions.xml + + + + spt-checks + validate + + check + + + config/checkstyle/spt_checks.xml + + + + maven-compiler-plugin ${maven-compiler-plugin.version} @@ -101,6 +147,7 @@ true -Xlint:all + -Xlint:-processing -parameters -Werror @@ -109,20 +156,6 @@ maven-dependency-plugin ${maven-dependency-plugin.version} - - - - org.apache.maven.shared - maven-dependency-analyzer - ${maven-dependency-analyzer.version} - - - - org.ow2.asm - asm - ${asm.version} - - analyze @@ -132,6 +165,8 @@ true true + true + org.springframework.boot:spring-boot-configuration-processor @@ -139,56 +174,68 @@ maven-enforcer-plugin ${maven-enforcer-plugin.version} - - - enforce - compile - - enforce - - - - - - - - - maven-checkstyle-plugin - ${checkstyle-maven-plugin.version} - - - com.puppycrawl.tools - checkstyle - ${checkstyle.version} - - + maven-gpg-plugin + ${maven-gpg-plugin.version} + + + maven-javadoc-plugin + ${maven-javadoc-plugin.version} + + + maven-pmd-plugin + ${maven-pmd-plugin.version} + + + maven-release-plugin + ${maven-release-plugin.version} - true - true - false + deploy + [skip ci] [maven-release-plugin] + @{project.version} - - - - check - - - + + + maven-scm-plugin + ${maven-scm-plugin.version} + + + maven-source-plugin + ${maven-source-plugin.version} + + + maven-surefire-plugin + ${maven-surefire-plugin.version} + + false + + **/*Tests.java + **/*Test.java + + + **/*IT.java + + + + + org.codehaus.mojo + license-maven-plugin + ${license-maven-plugin.version} + + + org.codehaus.mojo + versions-maven-plugin + + ${project.build.directory}/dependency-versions.txt + file:///${project.basedir}/config/versions/version-rules.xml + + ${versions-maven-plugin.version} com.github.spotbugs spotbugs-maven-plugin ${spotbugs.version} - - - - org.ow2.asm - asm - ${asm.version} - - Max Low @@ -205,7 +252,7 @@ ${findbugs-sec-bug-pattern.version} - ${project.basedir}/findbugs-exclude.xml + ${project.basedir}/config/findbugs/findbugs-exclude.xml @@ -217,20 +264,6 @@ - - maven-surefire-plugin - ${maven-surefire-plugin.version} - - false - - **/*Tests.java - **/*Test.java - - - **/*IT.java - - - org.jacoco jacoco-maven-plugin @@ -271,33 +304,30 @@ - org.pitest - pitest-maven - ${pitest-maven.version} - - - org.pitest - pitest-junit5-plugin - ${pitest-junit5-plugin.version} - - + org.owasp + dependency-check-maven + ${dependency-check-maven.version} - 100 + + false + + false + + 0 + + ${project.basedir}/config/owasp/suppress.xml + - org.codehaus.mojo - versions-maven-plugin - ${versions-maven-plugin.version} + org.pitest + pitest-maven + ${pitest-maven.version} - maven-release-plugin - ${maven-release-plugin.version} - - deploy - [skip ci] [maven-release-plugin] - @{project.version} - + org.sonatype.plugins + nexus-staging-maven-plugin + ${nexus-staging-plugin.version} @@ -305,17 +335,200 @@ org.codehaus.mojo - versions-maven-plugin + build-helper-maven-plugin + ${build-helper-maven-plugin.version} + + + parse-version + + parse-version + + + + + + maven-enforcer-plugin + + + parent-enforce + compile + + enforce + + + + + + + ${project.basedir}/README.md + ${project.basedir}/documentation/releases/release-${parsedVersion.majorVersion}.${parsedVersion.minorVersion}.${parsedVersion.incrementalVersion}.md + + + + + + + + + + org.owasp + dependency-check-maven - ${project.build.directory}/dependency-versions.txt - file:///${project.basedir}/maven-version-rules.xml + true - + + + + org.codehaus.mojo + versions-maven-plugin + + + + maven-scm-plugin + + + + all-quality-gates + + + + + + maven-pmd-plugin + + false + true + + config/pmd/rulesets/spt-default-rules.xml + config/pmd/rulesets/spt-main-rules.xml + + + + + pmd-main-check + validate + + check + + + + pmd-test-check + validate + + pmd + check + + + ${project.build.directory}/pmdTest/ + true + + ${basedir}/src/main/java + + + config/pmd/rulesets/spt-default-rules.xml + config/pmd/rulesets/spt-test-rules.xml + + + + + cpd-check + validate + + cpd-check + + + + + + + org.pitest + pitest-maven + + + org.pitest + pitest-junit5-plugin + ${pitest-junit5-plugin.version} + + + + 100 + + + + mutation-testing + verify + + mutationCoverage + + + + + + + org.codehaus.mojo + license-maven-plugin + + + compile + + add-third-party + + + true + + + CC0 1.0 Universal (CC0 1.0) Public Domain Dedication| + Public Domain, per Creative Commons CC0 + + Eclipse Distribution License - v1.0| + Eclipse Distribution License - v 1.0 + + Eclipse Public License - v1.0| + Eclipse Public License 1.0|Eclipse Public License - v 1.0|EDL 1.0 + + Eclipse Public License - v2.0| + Eclipse Public License 2.0|Eclipse Public License v2.0|EPL 2.0| + Eclipse Public License - v 2.0 + + The 2-Clause BSD License|BSD-2-Clause + + The 3-Clause BSD License|BSD License 3|BSD-3-Clause + + The Apache Software License, Version 2.0|Apache2| + Apache-2.0|Apache 2|APL2|Apache 2.0|Apache License, Version 2.0| + The Apache License, Version 2.0|Apache Software License - Version 2.0| + the Apache License, ASL Version 2.0|ASL 2.0|Apache License 2.0|ASL, version 2 + + The MIT License| + MIT license|The MIT License (MIT)|MIT License|MIT|MIT-style + + + + + CC0 1.0 Universal (CC0 1.0) Public Domain Dedication + Eclipse Distribution License - v1.0 + Eclipse Public License - v1.0 + Eclipse Public License - v2.0 + The 2-Clause BSD License + The 3-Clause BSD License + The Apache Software License, Version 2.0 + The MIT License + + + + + + + + + + + release @@ -329,20 +542,20 @@ - maven-source-plugin - ${maven-source-plugin.version} + maven-gpg-plugin - attach-sources + sign-artifacts + verify - jar-no-fork + sign + maven-javadoc-plugin - ${maven-javadoc-plugin.version} attach-javadocs @@ -351,30 +564,30 @@ + - maven-gpg-plugin - ${maven-gpg-plugin.version} + maven-source-plugin - sign-artifacts - verify + attach-sources - sign + jar-no-fork + org.sonatype.plugins nexus-staging-maven-plugin - ${nexus-staging-plugin.version} true ossrh https://oss.sonatype.org/ true + @@ -401,6 +614,14 @@ + + + + maven-jxr-plugin + ${maven-jxr-plugin.version} + + + diff --git a/spt-development-logging-spring-boot-autoconfigure/config/checkstyle/google_checks_suppressions.xml b/spt-development-logging-spring-boot-autoconfigure/config/checkstyle/google_checks_suppressions.xml new file mode 100644 index 0000000..4717b60 --- /dev/null +++ b/spt-development-logging-spring-boot-autoconfigure/config/checkstyle/google_checks_suppressions.xml @@ -0,0 +1,17 @@ + + + + + + + + + + + + + + + \ No newline at end of file diff --git a/spt-development-logging-spring-boot-autoconfigure/config/checkstyle/spt_checks.xml b/spt-development-logging-spring-boot-autoconfigure/config/checkstyle/spt_checks.xml new file mode 100644 index 0000000..686a60f --- /dev/null +++ b/spt-development-logging-spring-boot-autoconfigure/config/checkstyle/spt_checks.xml @@ -0,0 +1,79 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + \ No newline at end of file diff --git a/spt-development-logging-spring-boot-autoconfigure/findbugs-exclude.xml b/spt-development-logging-spring-boot-autoconfigure/config/findbugs/findbugs-exclude.xml similarity index 100% rename from spt-development-logging-spring-boot-autoconfigure/findbugs-exclude.xml rename to spt-development-logging-spring-boot-autoconfigure/config/findbugs/findbugs-exclude.xml diff --git a/spt-development-logging-spring-boot-autoconfigure/config/owasp/suppress.xml b/spt-development-logging-spring-boot-autoconfigure/config/owasp/suppress.xml new file mode 100644 index 0000000..cbc052c --- /dev/null +++ b/spt-development-logging-spring-boot-autoconfigure/config/owasp/suppress.xml @@ -0,0 +1,3 @@ + + + \ No newline at end of file diff --git a/spt-development-logging-spring-boot-autoconfigure/config/pmd/rulesets/spt-default-rules.xml b/spt-development-logging-spring-boot-autoconfigure/config/pmd/rulesets/spt-default-rules.xml new file mode 100644 index 0000000..b7e0759 --- /dev/null +++ b/spt-development-logging-spring-boot-autoconfigure/config/pmd/rulesets/spt-default-rules.xml @@ -0,0 +1,177 @@ + + + + + SPT Development default ruleset used by the Maven PMD plugin. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/spt-development-logging-spring-boot-autoconfigure/config/pmd/rulesets/spt-main-rules.xml b/spt-development-logging-spring-boot-autoconfigure/config/pmd/rulesets/spt-main-rules.xml new file mode 100644 index 0000000..ea693e9 --- /dev/null +++ b/spt-development-logging-spring-boot-autoconfigure/config/pmd/rulesets/spt-main-rules.xml @@ -0,0 +1,23 @@ + + + + + SPT Development main ruleset used by the Maven PMD plugin. + + + + + + + + + + + + + + + diff --git a/spt-development-logging-spring-boot-autoconfigure/config/pmd/rulesets/spt-test-rules.xml b/spt-development-logging-spring-boot-autoconfigure/config/pmd/rulesets/spt-test-rules.xml new file mode 100644 index 0000000..7a9be97 --- /dev/null +++ b/spt-development-logging-spring-boot-autoconfigure/config/pmd/rulesets/spt-test-rules.xml @@ -0,0 +1,14 @@ + + + + + SPT Development test ruleset used by the Maven PMD plugin. + + + + + + diff --git a/spt-development-logging-spring-boot-autoconfigure/maven-version-rules.xml b/spt-development-logging-spring-boot-autoconfigure/config/versions/version-rules.xml similarity index 100% rename from spt-development-logging-spring-boot-autoconfigure/maven-version-rules.xml rename to spt-development-logging-spring-boot-autoconfigure/config/versions/version-rules.xml diff --git a/spt-development-logging-spring-boot-autoconfigure/pom.xml b/spt-development-logging-spring-boot-autoconfigure/pom.xml index 2bc3a0c..8c9b0e4 100644 --- a/spt-development-logging-spring-boot-autoconfigure/pom.xml +++ b/spt-development-logging-spring-boot-autoconfigure/pom.xml @@ -82,39 +82,55 @@ maven-enforcer-plugin - + + + parent-enforce + + true + + + + enforce + compile + + enforce + + + + + + ${maven.min.version} + + + + + + maven-checkstyle-plugin - - spt_checks.xml - - - - - com.github.spotbugs - spotbugs-maven-plugin - - ${project.basedir}/findbugs-exclude.xml - + maven-surefire-plugin + + com.github.spotbugs + spotbugs-maven-plugin + org.jacoco jacoco-maven-plugin - org.codehaus.mojo - versions-maven-plugin + org.owasp + dependency-check-maven - ${project.build.directory}/dependency-versions.txt - file:///${project.basedir}/maven-version-rules.xml + false - + maven-release-plugin @@ -130,32 +146,23 @@ - release - - - - release - - - + + all-quality-gates - maven-source-plugin - - - - maven-javadoc-plugin - + org.pitest + pitest-maven + - maven-gpg-plugin - + maven-pmd-plugin + - org.sonatype.plugins - nexus-staging-maven-plugin - + org.codehaus.mojo + license-maven-plugin + diff --git a/spt-development-logging-spring-boot-autoconfigure/spt_checks.xml b/spt-development-logging-spring-boot-autoconfigure/spt_checks.xml deleted file mode 100644 index ab8d96f..0000000 --- a/spt-development-logging-spring-boot-autoconfigure/spt_checks.xml +++ /dev/null @@ -1,294 +0,0 @@ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - \ No newline at end of file diff --git a/spt-development-logging-spring-boot-starter/config/owasp/suppress.xml b/spt-development-logging-spring-boot-starter/config/owasp/suppress.xml new file mode 100644 index 0000000..3df6d08 --- /dev/null +++ b/spt-development-logging-spring-boot-starter/config/owasp/suppress.xml @@ -0,0 +1,11 @@ + + + + + + ^pkg:maven/org\.yaml/snakeyaml@.*$ + CVE-2022-1471 + + \ No newline at end of file diff --git a/spt-development-logging-spring-boot-starter/maven-version-rules.xml b/spt-development-logging-spring-boot-starter/config/versions/version-rules.xml similarity index 100% rename from spt-development-logging-spring-boot-starter/maven-version-rules.xml rename to spt-development-logging-spring-boot-starter/config/versions/version-rules.xml diff --git a/spt-development-logging-spring-boot-starter/pom.xml b/spt-development-logging-spring-boot-starter/pom.xml index 8d6aff6..35123a2 100644 --- a/spt-development-logging-spring-boot-starter/pom.xml +++ b/spt-development-logging-spring-boot-starter/pom.xml @@ -57,16 +57,38 @@ maven-enforcer-plugin - + + + parent-enforce + + true + + + + enforce + compile + + enforce + + + + + + ${maven.min.version} + + + + + + - org.codehaus.mojo - versions-maven-plugin + org.owasp + dependency-check-maven - ${project.build.directory}/dependency-versions.txt - file:///${project.basedir}/maven-version-rules.xml + false - + maven-release-plugin @@ -77,32 +99,14 @@ - release - - - - release - - - + + all-quality-gates - maven-source-plugin - - - - maven-javadoc-plugin - - - - maven-gpg-plugin - - - - org.sonatype.plugins - nexus-staging-maven-plugin - + org.codehaus.mojo + license-maven-plugin +