Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Use HMCTS Java plugin for code quality tools #176

Merged
merged 5 commits into from
Feb 27, 2024
Merged

Use HMCTS Java plugin for code quality tools #176

Show file tree
Hide file tree
Changes from 3 commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
e42c536
Integrate HMCTS Java Plugin
banderous Apr 17, 2020
f653fb4
Merge branch 'master' into gradle-plugin
banderous Apr 17, 2020
32587c7
Update Readme
banderous Apr 17, 2020
8555fb5
Bump gradle-java-plugin to 0.5.0
banderous Apr 20, 2020
08f0aad
Merge master
Michael1142 Feb 26, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
35 changes: 21 additions & 14 deletions README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -14,6 +14,7 @@ The template is a working application with a minimal setup. It contains:
* application skeleton
* setup script to prepare project
* common plugins and libraries
* [HMCTS Java plugin](https://github.com/hmcts/gradle-java-plugin)
* docker setup
* swagger configuration for api documentation ([see how to publish your api documentation to shared repository](https://github.com/hmcts/reform-api-docs#publish-swagger-docs))
* code quality tools already set up
Expand All @@ -29,19 +30,32 @@ The application exposes health endpoint (http://localhost:4550/health) and metri

The template contains the following plugins:

* checkstyle
* HMCTS Java plugin

https://docs.gradle.org/current/userguide/checkstyle_plugin.html
Applies code analysis tools with HMCTS default settings. See the [project repository](https://github.com/hmcts/gradle-java-plugin) for details.

Performs code style checks on Java source files using Checkstyle and generates reports from these checks.
The checks are included in gradle's *check* task (you can run them by executing `./gradlew check` command).
Analysis tools include:

* pmd
* checkstyle

https://docs.gradle.org/current/userguide/pmd_plugin.html
https://docs.gradle.org/current/userguide/checkstyle_plugin.html

Performs static code analysis to finds common programming flaws. Included in gradle `check` task.
Performs code style checks on Java source files using Checkstyle and generates reports from these checks.
The checks are included in gradle's *check* task (you can run them by executing `./gradlew check` command).

* pmd

https://docs.gradle.org/current/userguide/pmd_plugin.html

Performs static code analysis to finds common programming flaws. Included in gradle `check` task.

* org.owasp.dependencycheck

https://jeremylong.github.io/DependencyCheck/dependency-check-gradle/index.html

Provides monitoring of the project's dependent libraries and creating a report
of known vulnerable components that are included in the build. To run it
execute `gradle dependencyCheck` command.

* jacoco

Expand Down Expand Up @@ -70,13 +84,6 @@ The template contains the following plugins:

Reduces the amount of work needed to create a Spring application

* org.owasp.dependencycheck

https://jeremylong.github.io/DependencyCheck/dependency-check-gradle/index.html

Provides monitoring of the project's dependent libraries and creating a report
of known vulnerable components that are included in the build. To run it
execute `gradle dependencyCheck` command.

* com.github.ben-manes.versions

Expand Down
31 changes: 5 additions & 26 deletions build.gradle
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,11 +1,13 @@
plugins {
id 'application'
id 'checkstyle'
id 'pmd'
id 'jacoco'
/*
Applies analysis tools including checkstyle, PMD and OWASP Dependency checker.
See https://github.com/hmcts/gradle-java-plugin
*/
id 'uk.gov.hmcts.java' version '0.4.2'
id 'io.spring.dependency-management' version '1.0.9.RELEASE'
id 'org.springframework.boot' version '2.2.6.RELEASE'
id 'org.owasp.dependencycheck' version '5.3.2.1'
id 'com.github.ben-manes.versions' version '0.28.0'
id 'org.sonarqube' version '2.8'
}
Expand Down Expand Up @@ -84,21 +86,6 @@ task smoke(type: Test) {
classpath = sourceSets.smokeTest.runtimeClasspath
}

checkstyle {
maxWarnings = 0
toolVersion = '8.29'
getConfigDirectory().set(new File(rootDir, 'config/checkstyle'))
}

pmd {
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

do we want to keep PMD enabled? sonarqube is supposed to cover it
moving this to the plugin makes it harder to disable or alter the config in a team project I assume?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The default PMD settings can be extended with additional rulesets or replaced completely with custom rulesets if desired in buildscript.

Sonarqube runs PMD if I understand correctly? So we'd still want control of the PMD rulesets. Also does sonarqube run analysis locally or just on CI?

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

no they've written their own static analysis tool afaik, they used to.

It runs on CI but you can run it locally with sonarlint

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Re: disabling rulesets. If teams have a need to blanket remove an entire rule then it probably shouldn't be in the default HMCTS rulesets (teams can suppress individual violations where necessary).

For example, I did remove one PMD rule that doesn't work correctly with modern Java constructs like foreach loops.

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

There are a lot of PMD rules which report on "issues" we don't really care. I think by default it should be disabled and have an option to enable and override if necessary

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

or just not include it?
@satyachundur ?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Agreed we don't want to impose a tool with a bad signal to noise ratio. I'll go through the PMD warnings for a couple of our larger projects and see if it flags up anything useful, and either trim back the ruleset or remove the tool completely.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@timja @satyachundur PMD is no longer applied in the java plugin. Are you happy to proceed with this PR as is?

toolVersion = "6.18.0"
sourceSets = [sourceSets.main, sourceSets.test, sourceSets.functionalTest, sourceSets.integrationTest, sourceSets.smokeTest]
reportsDir = file("$project.buildDir/reports/pmd")
// https://github.com/pmd/pmd/issues/876
ruleSets = []
ruleSetFiles = files("config/pmd/ruleset.xml")
}

jacocoTestReport {
executionData(test, integration)
reports {
Expand Down Expand Up @@ -132,15 +119,7 @@ dependencyUpdates {

// https://jeremylong.github.io/DependencyCheck/dependency-check-gradle/configuration.html
dependencyCheck {
// Specifies if the build should be failed if a CVSS score above a specified level is identified.
// range of 0-10 fails the build, anything greater and it doesn't fail the build
failBuildOnCVSS = System.getProperty('dependencyCheck.failBuild') == 'true' ? 0 : 11
suppressionFile = 'config/owasp/suppressions.xml'

analyzers {
// Disable scanning of .NET related binaries
assemblyEnabled = false
}
}

dependencyManagement {
Expand Down
251 changes: 0 additions & 251 deletions config/checkstyle/checkstyle.xml
View file
Open in desktop

This file was deleted.

Loading