Updated dependencies

.github/workflows/publish.yml

@@ -0,0 +1,34 @@
+# Publish to Maven Central
+
+name: publish
+
+on:
+  release:
+    types: [ created ]
+  workflow_dispatch: {}
+
+jobs:
+  publish:
+
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v3
+
+      - name: Set up JDK
+        uses: actions/setup-java@v3
+        with:
+          distribution: 'adopt'
+          java-version: '17'
+          cache: 'gradle'
+
+      - name: Publish
+        run: |
+          chmod +x gradlew
+          ./gradlew publishToSonatype closeAndReleaseSonatypeStagingRepository
+        env:
+          ORG_GRADLE_PROJECT_nexusUsername: ${{ secrets.NEXUS_USERNAME }}
+          ORG_GRADLE_PROJECT_nexusPassword: ${{ secrets.NEXUS_PASSWORD }}
+          ORG_GRADLE_PROJECT_signingKey: ${{ secrets.SEER_GPG_SECRET_KEY }}
+          ORG_GRADLE_PROJECT_signingPassword: ${{ secrets.SEER_GPG_PASSWORD }}

build.gradle

@@ -4,20 +4,18 @@ plugins {
     id 'java-library'
     id 'checkstyle'
     id 'jacoco'
-    id 'com.github.spotbugs' version '5.0.14'
+    id 'com.github.spotbugs' version '6.0.1'
     id 'maven-publish'
     id 'signing'
-    id 'io.github.gradle-nexus.publish-plugin' version '1.1.0' // publish to Maven Central
-    id 'org.sonatype.gradle.plugins.scan' version '2.6.0'
-    id "com.github.ben-manes.versions" version '0.47.0'
-    id "org.sonarqube" version "4.2.1.3168"
+    id 'io.github.gradle-nexus.publish-plugin' version '1.3.0' // publish to Maven Central
+    id 'com.github.ben-manes.versions' version '0.50.0' // check for out-of-date dependencies (run 'dependencyUpdates' manually)
+    id 'org.sonatype.gradle.plugins.scan' version '2.6.1' // scan for vulnerabilities
+    id "org.sonarqube" version "4.4.1.3373"// sonarQube analysis
 }
 
 group = 'com.imsweb'
 version = file('VERSION').text
 description = 'This library provides support for the NAACCR XML format.'
-sourceCompatibility = JavaVersion.VERSION_1_8
-targetCompatibility = JavaVersion.VERSION_1_8
 
 println "Starting build using JDK ${Runtime.version().feature()}"
 
@@ -28,27 +26,30 @@ repositories {
 dependencies {
     api 'com.thoughtworks.xstream:xstream:1.4.20'
 
-    implementation 'commons-io:commons-io:2.13.0'
-    implementation 'org.apache.commons:commons-lang3:3.12.0'
+    implementation 'commons-io:commons-io:2.15.1'
+    implementation 'org.apache.commons:commons-lang3:3.14.0'
 
     testImplementation 'junit:junit:4.13.2'
-    testImplementation 'com.imsweb:data-generator:1.29'
-    testImplementation 'com.opencsv:opencsv:5.7.1'
+    testImplementation 'com.imsweb:data-generator:1.31'
+    testImplementation 'com.opencsv:opencsv:5.9'
 }
 
 // enforce UTF-8, display the compilation warnings
-tasks.withType(JavaCompile) {
+tasks.withType(JavaCompile).configureEach {
     options.encoding = 'UTF-8'
     options.compilerArgs << '-Xlint:unchecked' << '-Xlint:deprecation'
 }
 
 // the Javadoc was made way too strict in Java 8 and it's not worth the time fixing everything!
-tasks.withType(Javadoc) {
+tasks.withType(Javadoc).configureEach {
     options.addStringOption('Xdoclint:none', '-quiet')
 }
 
 // generate javadoc and sources (required by Nexus)
 java {
+    sourceCompatibility = JavaVersion.VERSION_1_8
+    targetCompatibility = JavaVersion.VERSION_1_8
+
     withJavadocJar()
     withSourcesJar()
 }
@@ -78,6 +79,8 @@ sonarqube {
         property "sonar.projectKey", "imsweb_naaccr-xml"
         property "sonar.organization", "imsweb"
         property "sonar.host.url", "https://sonarcloud.io"
+        property 'sonar.exclusions', '**/lab/*'
+        property 'sonar.coverage.exclusions', '**/lab/*'
     }
 }
 
@@ -98,7 +101,7 @@ checkstyle {
 // spotbugs plugin settings
 spotbugs {
     ignoreFailures = false
-    excludeFilter = project(':').file("config/spotbugs/spotbugs-exclude.xml")
+    excludeFilter.set(project(':').file("config/spotbugs/spotbugs-exclude.xml"))
 }
 
 jacocoTestReport {
@@ -108,6 +111,19 @@ jacocoTestReport {
 }
 test.finalizedBy jacocoTestReport
 
+def isNonStable = { String version ->
+    def stableKeyword = ['RELEASE', 'FINAL', 'GA'].any { it -> version.toUpperCase().contains(it) }
+    def regex = /^[0-9,.v-]+(-r)?$/
+    return !stableKeyword && !(version ==~ regex)
+}
+
+// https://github.com/ben-manes/gradle-versions-plugin
+tasks.named("dependencyUpdates").configure {
+    rejectVersionIf {
+        isNonStable(it.candidate.version)
+    }
+}
+
 // needed to deploy to Maven Central
 publishing {
     publications {
@@ -156,8 +172,10 @@ publishing {
 
 // setup JAR signing
 signing {
-    def signingKey = project.findProperty('signing.armored.key') ?: ''
-    def signingPassword = project.findProperty('signing.armored.password') ?: ''
+    required { !project.version.endsWith('-SNAPSHOT') }
+
+    String signingKey = project.findProperty('signing.armored.key') ?: ''
+    String signingPassword = project.findProperty('signing.armored.password') ?: ''
 
     useInMemoryPgpKeys(signingKey, signingPassword)
 
@@ -185,20 +203,12 @@ nexusPublishing {
     }
 }
 
-// don't try to release a snapshot to a non-snapshot repository, that won't work anyway
-if (version.endsWith('-SNAPSHOT')) {
-    gradle.startParameter.excludedTaskNames += 'signMavenJavaPublication'
-    gradle.startParameter.excludedTaskNames += 'closeAndReleaseSonatypeStagingRepository'
-}
-
 // Gradle wrapper, this allows to build the project without having to install Gradle...
 wrapper {
-    gradleVersion = '7.5.1'
+    gradleVersion = '8.5'
     distributionType = Wrapper.DistributionType.ALL
 }
 
 // the SAS library is compiled under Java 7 code-compatibility; Intellij can't handle that (only because I didn't properly set it up as a module)
 if (System.getProperty("idea.active") != 'true')
     apply from: 'gradle/sas.gradle'
-
-apply from: 'gradle/release.gradle'

config/spotbugs/spotbugs-exclude.xml

@@ -26,4 +26,8 @@
         <Bug code="NP"/>
         <Class name="com.imsweb.naaccrxml.runtime.NaaccrDictionaryConverter"/>
     </Match>
+    <Match>
+        <!-- Be wary of letting constructors throw exceptions, not easy to fix, and I don't think that can create a problem -->
+        <Bug pattern="CT_CONSTRUCTOR_THROW"/>
+    </Match>
 </FindBugsFilter>

gradle/sas.gradle

@@ -23,13 +23,37 @@ compileSasJava {
     targetCompatibility = JavaVersion.VERSION_1_7
 }
 
-task jarSas(type: Jar) {
-    dependsOn compileSasJava
+tasks.register('jarSas', Jar) {
     from sourceSets.sas.output
     archiveClassifier = 'sas'
+    dependsOn compileSasJava
 }
 
-task sourcesSasJar(type: Jar, dependsOn: sasClasses) {
+tasks.register('sourcesSasJar', Jar) {
     from sourceSets.sas.allSource
     archiveClassifier = 'sas-sources'
+    dependsOn 'sasClasses'
+}
+
+tasks.register('assembleDistribution') {
+    group = 'distribution'
+    doLast {
+        // SAS stuff
+        copy {
+            from "build/libs/${project.name}-${project.version}-sas.jar"
+            from 'docs/sas/macro/read_naaccr_xml_macro.sas'
+            from 'docs/sas/macro/write_naaccr_xml_macro.sas'
+            into 'build/dist/sas'
+        }
+    }
+    dependsOn 'assemble', 'jarSas', 'sourcesSasJar'
+}
+
+tasks.register('createDistribution', Zip) {
+    group = 'distribution'
+    archiveFileName = "naaccr-xml-utility-${project.version}.zip"
+    destinationDirectory = file('build')
+    from 'build/dist'
+    into "naaccr-xml-utility-${project.version}"
+    dependsOn 'assembleDistribution'
 }

gradle/wrapper/gradle-wrapper.properties

@@ -1,5 +1,5 @@
 distributionBase=GRADLE_USER_HOME
 distributionPath=wrapper/dists
-distributionUrl=https\://services.gradle.org/distributions/gradle-7.5.1-all.zip
+distributionUrl=https\://services.gradle.org/distributions/gradle-8.5-all.zip
 zipStoreBase=GRADLE_USER_HOME
 zipStorePath=wrapper/dists

settings.gradle

@@ -1 +1,4 @@
-rootProject.name = 'naaccr-xml'
+rootProject.name = 'naaccr-xml'
+
+// following can be removed when sonarQube plugin is upgraded to 5.x
+System.setProperty('sonar.gradle.skipCompile', 'true')