[bump] com.diffplug.spotless:8.0.0

.github/workflows/gradle.yml

@@ -73,8 +73,8 @@ jobs:
           restore-keys: |
             ${{ runner.os }}-go-
 
-      - name: Gradle clean + spotlessCheck
-        run: ./gradlew clean spotlessCheck
+      - name: Gradle SanityCheck
+        run: ./gradlew clean spotlessCheck rewriteDryRun -Dorg.gradle.jvmargs=-Xmx8G
 
       - name: Build Client
         run: ./gradlew :sechub-cli:buildGo :sechub-cli:testGo

.github/workflows/release-client-server-pds.yml

@@ -131,7 +131,7 @@ jobs:
           password: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Gradle clean + spotlessCheck
-        run: ./gradlew clean spotlessCheck
+        run: ./gradlew clean spotlessCheck rewriteDryRun -Dorg.gradle.jvmargs=-Xmx8G
 
       # ----------------------
       # Create pull request if license headers are missing

build.gradle

@@ -1,90 +1,79 @@
 // SPDX-License-Identifier: MIT
-buildscript{
-	apply from: "${rootProject.projectDir}/gradle/libraries.gradle"
-	apply from: "${rootProject.projectDir}/gradle/projects.gradle"
+buildscript {
+    apply from: "${rootProject.projectDir}/gradle/libraries.gradle"
+    apply from: "${rootProject.projectDir}/gradle/projects.gradle"
 
     def customMavenRepoURL4plugins = System.getenv('CUST_MVN_URL_PLUGINS')
-    if (customMavenRepoURL4plugins!=null){
+    if (customMavenRepoURL4plugins != null) {
         repositories {
             maven { url "${customMavenRepoURL4plugins}" } // e.g. a corporate nexus or artifactory...
         }
-    }else{
-    	repositories {
-    	     mavenCentral()
-    	}
+    } else {
+        repositories {
+            mavenCentral()
+        }
     }
 
-	dependencies{
-		classpath gradleApi()
-		classpath "org.ajoberstar.grgit:grgit-gradle:${libraryVersion.grgit}" // necessary for version calculation
-		classpath "com.epages:restdocs-api-spec-gradle-plugin:${libraryVersion.restDocsApiSpec}"
+    dependencies {
+        classpath gradleApi()
+        classpath "org.ajoberstar.grgit:grgit-gradle:${libraryVersion.grgit}" // necessary for version calculation
+        classpath "com.epages:restdocs-api-spec-gradle-plugin:${libraryVersion.restDocsApiSpec}"
         classpath "org.owasp:dependency-check-gradle:${libraryVersion.dependency_check}"
         classpath "org.cyclonedx:cyclonedx-gradle-plugin:${libraryVersion.cyclonedx_gradle_plugin}"
-	}
+    }
 }
 
 
 plugins {
-    // asciidoc
+    id 'com.diffplug.spotless' version '8.0.0'
+    id 'com.github.ben-manes.versions' version '0.50.0' // versions plugin for checking new available library versions etc. (see https://github.com/ben-manes/gradle-versions-plugin)
     id 'org.asciidoctor.jvm.convert' version '3.3.2'
     id 'org.asciidoctor.jvm.pdf' version '3.3.2'
-
-    // open api
     id 'org.openapi.generator' version '7.8.0'
-
-    // spring
+    id 'org.openrewrite.rewrite' version '7.20.0' apply false
     id 'org.springframework.boot' version '3.3.5' apply false
-
-    // spotless code formatter
-    // (see https://github.com/diffplug/spotless)
-    id 'com.diffplug.spotless' version '6.23.3'
-
-    // versions plugin for checking new available library versions etc. 
-    // (see https://github.com/ben-manes/gradle-versions-plugin)
-    id 'com.github.ben-manes.versions' version '0.50.0'
-
-    // Details about every gradle plugin can be found at 
-    // https://plugins.gradle.org/plugin/${pluginId}
 }
 
+apply from: "$rootDir/gradle/rewrite.gradle"
+
 // old style apply necessary here - to have same version as in classpath dependency
 apply plugin: 'org.owasp.dependencycheck'
 
 // applying cyclonDX plugin
 apply plugin: 'org.cyclonedx.bom'
 // generate sbom only with runtime dependencies
 cyclonedxBom {
-  includeConfigs = ["runtimeClasspath"]
+    includeConfigs = ["runtimeClasspath"]
 }
 
 /* check buildsystem */
 def githubActor = System.getenv('GITHUB_ACTOR')
 
 def atGitHubActions = false
 
-if (githubActor == null || githubActor.isEmpty()){
+if (githubActor == null || githubActor.isEmpty()) {
     /* not inside github actions */
     atGitHubActions = false
-}else{
+} else {
     atGitHubActions = true
 }
 
 /* define global `buildDoneByGitHubActions` - so sub projects can reuse this information*/
-ext.buildDoneByGitHubActions=atGitHubActions
+ext.buildDoneByGitHubActions = atGitHubActions
 ext.springBootMavenBomCoordinates = org.springframework.boot.gradle.plugin.SpringBootPlugin.BOM_COORDINATES
 
 ext {
     git = org.ajoberstar.grgit.Grgit.open(currentDir: project.rootDir) // necessary for version calculation
 }
 
 /* own clean task - we need this because root project has not included a module providing the task */
-task internalCleanRootBuildFolder(type: Delete){
+task internalCleanRootBuildFolder(type: Delete) {
 
     doFirst {
         def rootBuildFolder = file("${project.projectDir}/build")
-        if (! rootBuildFolder.exists()){
+        if (!rootBuildFolder.exists()) {
             rootBuildFolder.mkdirs()
-        } 
+        }
         delete rootBuildFolder.listFiles() // so we do NOT clear buildSrc/build here!
     }
 
@@ -99,19 +88,19 @@ allprojects {
     apply from: rootProject.file('gradle/spotless.gradle')
 
     def customMavenRepoURL = System.getenv('CUST_MVN_URL')
-    if (customMavenRepoURL!=null){
+    if (customMavenRepoURL != null) {
         repositories {
             maven { url "${customMavenRepoURL}" } // e.g. a corporate nexus or artifactory...
         }
-    }else{
+    } else {
         repositories {
-             mavenCentral()
+            mavenCentral()
         }
     }
 
     /* every project has got this additional task */
-    task prepareGitPush(dependsOn: spotlessApply){
-    
+    task prepareGitPush(dependsOn: spotlessApply) {
+
     }
 
     /*
@@ -126,17 +115,16 @@ allprojects {
 }
 
 
-
 spotless {
-	groovyGradle {
-		target '*.gradle', 'gradle/*.gradle'
-	}
-	format 'dotfiles', {
-		target '.gitignore', '.gitattributes', '.editorconfig'
-		indentWithSpaces(2)
-		trimTrailingWhitespace()
-		endWithNewline()
-	}
+    groovyGradle {
+        target '*.gradle', 'gradle/*.gradle'
+    }
+    format 'dotfiles', {
+        target '.gitignore', '.gitattributes', '.editorconfig'
+        indentWithSpaces(2)
+        trimTrailingWhitespace()
+        endWithNewline()
+    }
 }
 
 apply from: "${rootProject.projectDir}/gradle/build-versioning.gradle"

docs/latest/sechub-developer-quickstart-guide.html

@@ -1551,7 +1551,7 @@ <h4 id="add-sechub-java-code-formatter">4.1.1. Add Sechub Java Code Formatter</h
 <p>Before pushing your code please check your java format by executing spotless check.</p>
 <div class="listingblock">
 <div class="content">
-<pre>./gradlew clean spotlessCheck</pre>
+<pre>./gradlew clean spotlessCheck rewriteDryRun -Dorg.gradle.jvmargs=-Xmx8G</pre>
 </div>
 </div>
 </li>
@@ -1649,7 +1649,7 @@ <h4 id="add-sechub-java-code-formatter-2">4.2.1. Add Sechub Java Code Formatter<
 <p>Before pushing your code please check your java format by executing spotless check.</p>
 <div class="listingblock">
 <div class="content">
-<pre>./gradlew clean spotlessCheck</pre>
+<pre>./gradlew clean spotlessCheck rewriteDryRun -Dorg.gradle.jvmargs=-Xmx8G</pre>
 </div>
 </div>
 </li>

docs/latest/sechub-techdoc.html

@@ -1883,7 +1883,7 @@ <h6 id="add-sechub-java-code-formatter">2.1.3.1.3. Add Sechub Java Code Formatte
 <p>Before pushing your code please check your java format by executing spotless check.</p>
 <div class="listingblock">
 <div class="content">
-<pre>./gradlew clean spotlessCheck</pre>
+<pre>./gradlew clean spotlessCheck rewriteDryRun -Dorg.gradle.jvmargs=-Xmx8G</pre>
 </div>
 </div>
 </li>
@@ -1936,7 +1936,7 @@ <h6 id="add-sechub-java-code-formatter-intellij">2.1.3.2.3. Add Sechub Java Code
 <p>Before pushing your code please check your java format by executing spotless check.</p>
 <div class="listingblock">
 <div class="content">
-<pre>./gradlew clean spotlessCheck</pre>
+<pre>./gradlew clean spotlessCheck rewriteDryRun -Dorg.gradle.jvmargs=-Xmx8G</pre>
 </div>
 </div>
 </li>

gradle.properties

@@ -1,3 +1,4 @@
+org.gradle.caching=true
 # SPDX-License-Identifier: MIT
 # =============================================================================
 # Specific gradle setup for project 'sechub'

gradle/rewrite.gradle

@@ -0,0 +1,26 @@
+/*
+ * SPDX-License-Identifier: Apache-2.0
+ *
+ * The OpenSearch Contributors require contributions made to
+ * this file be licensed under the Apache-2.0 license or a
+ * compatible open source license.
+ */
+
+project.apply plugin: 'org.openrewrite.rewrite'
+
+rewrite {
+  activeRecipe('com.mercedesbenz.sechub.openrewrite.SanityCheck')
+  exclusions.addAll('**/gen/src/main**')
+  setExportDatatables(true)
+  setFailOnDryRunResults(true)
+}
+
+dependencies {
+    rewrite(platform("org.openrewrite.recipe:rewrite-recipe-bom:3.18.0"))
+    rewrite("org.openrewrite.recipe:rewrite-migrate-java:3.21.1")
+    rewrite("org.openrewrite.recipe:rewrite-java-security:3.20.0")
+    rewrite("org.openrewrite.recipe:rewrite-rewrite:0.15.0")
+    rewrite("org.openrewrite.recipe:rewrite-spring:6.18.0")
+    rewrite("org.openrewrite.recipe:rewrite-static-analysis:2.21.0")
+    rewrite("org.openrewrite.recipe:rewrite-third-party:0.30.0")
+}

rewrite.yml

@@ -0,0 +1,18 @@
+---
+type: specs.openrewrite.org/v1beta/recipe
+name: com.mercedesbenz.sechub.openrewrite.SanityCheck
+displayName: Apply all Java & Gradle best practices
+description: Comprehensive code quality recipe combining modernization, security, and best practices.
+tags:
+  - java
+  - gradle
+  - static-analysis
+  - cleanup
+recipeList:
+  - org.openrewrite.gradle.EnableGradleBuildCache
+  - org.openrewrite.gradle.EnableGradleParallelExecution
+  # - org.openrewrite.java.RemoveUnusedImports
+  # - org.openrewrite.java.spring.boot3.SpringBoot33BestPractices
+  # - org.openrewrite.gradle.GradleBestPractices
+  # - org.openrewrite.java.migrate.UpgradeToJava17
+---

sechub-adapter-checkmarx/src/test/java/com/mercedesbenz/sechub/adapter/checkmarx/CheckmarxAdapterV1WireMockTest.java

@@ -99,7 +99,7 @@ protected APIURLSupport createAPIURLSupport() {
 
     @Test
     public void when_checkmarx_has_only_unsupported_files_the_result_is_canceled() throws Exception {
-        when(config.getTimeOutInMilliseconds()).thenReturn(1000 * 1000* 5);
+        when(config.getTimeOutInMilliseconds()).thenReturn(1000 * 1000 * 5);
 
         /* prepare */
         LinkedHashMap<String, String> loginResponse = login(3600);
@@ -125,12 +125,12 @@ public void when_checkmarx_has_only_unsupported_files_the_result_is_canceled() t
         simulateWaitForQueingDoneReturnsFailureWithText("source folder is empty, all source files are of an unsupported language or file format");
 
         /* execute */
-        AdapterExecutionResult adapterResult = executeAndLogHistoryOnFailure(()->adapterToTest.start(config, callback));
+        AdapterExecutionResult adapterResult = executeAndLogHistoryOnFailure(() -> adapterToTest.start(config, callback));
 
         /* @formatter:on */
         /* test */
         assertEquals("", adapterResult.getProductResult()); // empty result because canceled
-        assertEquals(true,adapterResult.hasBeenCanceled());
+        assertEquals(true, adapterResult.hasBeenCanceled());
         history.assertAllRememberedUrlsWereRequested();
     }
 

sechub-adapter-checkmarx/src/test/java/com/mercedesbenz/sechub/adapter/checkmarx/CheckmarxResilienceConsultantTest.java

@@ -120,8 +120,7 @@ void socket_exception_returns_retry_proposal_with_networkerror_config() {
     @Test
     void nested_http_bad_request_400_exception_wrapped_in_runtime_and_sechubexecution_exception_returns_retry_proposal_with_badrequest_config() {
         /* prepare */
-        when(context.getCurrentError())
-                .thenReturn(new IOException("se1", new RuntimeException(new HttpClientErrorException(HttpStatus.BAD_REQUEST))));
+        when(context.getCurrentError()).thenReturn(new IOException("se1", new RuntimeException(new HttpClientErrorException(HttpStatus.BAD_REQUEST))));
 
         /* execute */
         ResilienceProposal proposal = consultantToTest.consultFor(context);
@@ -134,7 +133,7 @@ void nested_http_bad_request_400_exception_wrapped_in_runtime_and_sechubexecutio
     }
 
     @ParameterizedTest
-    @EnumSource(value = HttpStatus.class, names = {"INTERNAL_SERVER_ERROR", "BAD_GATEWAY", "SERVICE_UNAVAILABLE", "GATEWAY_TIMEOUT"})
+    @EnumSource(value = HttpStatus.class, names = { "INTERNAL_SERVER_ERROR", "BAD_GATEWAY", "SERVICE_UNAVAILABLE", "GATEWAY_TIMEOUT" })
     void http_server_error_5xx_exception_returns_retry_proposal_with_servererror_config(HttpStatus status) {
         /* prepare */
         when(context.getCurrentError()).thenReturn(new HttpServerErrorException(status));
@@ -150,7 +149,7 @@ void http_server_error_5xx_exception_returns_retry_proposal_with_servererror_con
     }
 
     @ParameterizedTest
-    @EnumSource(value = HttpStatus.class, names = {"UNAUTHORIZED", "FORBIDDEN", "NOT_FOUND", "METHOD_NOT_ALLOWED", "NOT_ACCEPTABLE"})
+    @EnumSource(value = HttpStatus.class, names = { "UNAUTHORIZED", "FORBIDDEN", "NOT_FOUND", "METHOD_NOT_ALLOWED", "NOT_ACCEPTABLE" })
     void http_client_error_4xx_exception_returns_null_when_consultant_can_not_handle(HttpStatus status) {
         /* prepare */
         when(context.getCurrentError()).thenReturn(new HttpClientErrorException(status));

sechub-administration/src/test/java/com/mercedesbenz/sechub/domain/administration/project/ProjectCreationServiceTest.java

@@ -108,7 +108,7 @@ void create_project_success_sends_events() {
 
         /* test */
         var messageCaptor = ArgumentCaptor.forClass(DomainMessage.class);
-        verify(eventBus,times(2)).sendAsynchron(messageCaptor.capture());
+        verify(eventBus, times(2)).sendAsynchron(messageCaptor.capture());
 
         List<DomainMessage> messages = messageCaptor.getAllValues();
         DomainMessage firstMessage = messages.get(0);
@@ -130,8 +130,7 @@ void create_project_already_exists() {
 
         /* execute + test */
         assertThatThrownBy(() -> projectCreationService.createProject(PROJECT_ID, DESCRIPTION, OWNER, WHITELIST, META_DATA))
-            .isInstanceOf(AlreadyExistsException.class)
-            .hasMessageContaining("already exists");
+                .isInstanceOf(AlreadyExistsException.class).hasMessageContaining("already exists");
     }
 
     @Test
@@ -142,7 +141,6 @@ void create_project_owner_not_found() {
 
         /* execute + test */
         assertThatThrownBy(() -> projectCreationService.createProject(PROJECT_ID, DESCRIPTION, OWNER, WHITELIST, META_DATA))
-            .isInstanceOf(NotFoundException.class)
-            .hasMessageContaining("not found");
+                .isInstanceOf(NotFoundException.class).hasMessageContaining("not found");
     }
 }