build.gradle

/*
 * Copyright OpenSearch Contributors
 * SPDX-License-Identifier: Apache-2.0
 */
import com.diffplug.gradle.spotless.JavaExtension
import org.opensearch.gradle.test.RestIntegTestTask

buildscript {
    ext {
        opensearch_version = System.getProperty("opensearch.version", "3.0.0-SNAPSHOT")
        isSnapshot = "true" == System.getProperty("build.snapshot", "true")
        buildVersionQualifier = System.getProperty("build.version_qualifier", "")
        version_tokens = opensearch_version.tokenize('-')
        opensearch_build = version_tokens[0] + '.0'
        plugin_no_snapshot = opensearch_build
        opensearch_no_snapshot = opensearch_version.replace("-SNAPSHOT","")
        sa_commons_version = '1.0.0'
        if (buildVersionQualifier) {
            opensearch_build += "-${buildVersionQualifier}"
        }

        alerting_spi_build = opensearch_build
        alerting_spi_build += "-SNAPSHOT"
        if (isSnapshot) {
            opensearch_build += "-SNAPSHOT"

            // TODO consider enabling snapshot options once SA commons is published to maven central
//            sa_commons_version += "-SNAPSHOT"
        }
        common_utils_version = System.getProperty("common_utils.version", opensearch_build)
        kotlin_version = '1.8.21'

        sa_commons_file_name = "security-analytics-commons-${sa_commons_version}.jar"
        sa_commons_file_path = "${project.rootDir}/${sa_commons_file_name}"
    }

    repositories {
        mavenLocal()
        mavenCentral()
        maven { url "https://aws.oss.sonatype.org/content/repositories/snapshots" }
    }

    dependencies {
        classpath "org.opensearch.gradle:build-tools:${opensearch_version}"
    }
}

plugins {
    id 'java'
    id 'com.diffplug.spotless' version '6.22.0'
    id "com.netflix.nebula.ospackage" version "11.5.0"
    id 'java-library'
}

apply plugin: 'opensearch.opensearchplugin'
apply plugin: 'opensearch.testclusters'
apply plugin: 'opensearch.java-rest-test'
apply plugin: 'opensearch.pluginzip'
apply from: 'gradle/formatting.gradle'

ext {
    projectSubstitutions = [:]
    licenseFile = rootProject.file('LICENSE')
    noticeFile = rootProject.file('NOTICE')
}

licenseHeaders.enabled = false
testingConventions.enabled = false
forbiddenApis.ignoreFailures = true

dependencyLicenses.enabled = false
thirdPartyAudit.enabled = false
forbiddenApisTest.ignoreFailures = true
validateNebulaPom.enabled = false
loggerUsageCheck.enabled = false

opensearchplugin {
    name 'opensearch-security-analytics'
    description 'OpenSearch Security Analytics plugin'
    classname 'org.opensearch.securityanalytics.SecurityAnalyticsPlugin'
    extendedPlugins = ['opensearch-job-scheduler', 'opensearch-alerting']
}

javaRestTest {
    // add "-Dtests.security.manager=false" to VM options if you want to run integ tests in IntelliJ
    systemProperty 'tests.security.manager', 'false'
}

testClusters.javaRestTest {
    testDistribution = 'INTEG_TEST'
}

allprojects {
    group = 'org.opensearch'
    version = opensearch_version.tokenize('-')[0] + '.0'
    if (buildVersionQualifier) {
        version += "-${buildVersionQualifier}"
    }
    if (isSnapshot) {
        version += "-SNAPSHOT"
    }

    apply from: "$rootDir/build-tools/repositories.gradle"

    java {
        targetCompatibility = JavaVersion.VERSION_11
        sourceCompatibility = JavaVersion.VERSION_11
    }
}

publishing {
    publications {
        pluginZip(MavenPublication) { publication ->
            pom {
                groupId = "org.opensearch.plugin"
                name = "opensearch-security-analytics"
                description = "OpenSearch Security Analytics plugin"
                licenses {
                    license {
                        name = "The Apache License, Version 2.0"
                        url = "http://www.apache.org/licenses/LICENSE-2.0.txt"
                    }
                }
                developers {
                    developer {
                        name = "OpenSearch"
                        url = "https://github.com/opensearch-project/security-analytics"
                    }
                }
            }
        }
    }

    repositories {
        maven {
            name = "Snapshots"
            url = "https://aws.oss.sonatype.org/content/repositories/snapshots"
            credentials {
                username "$System.env.SONATYPE_USERNAME"
                password "$System.env.SONATYPE_PASSWORD"
            }
        }
    }
}

repositories {
    mavenLocal()
    mavenCentral()
    maven { url "https://aws.oss.sonatype.org/content/repositories/snapshots" }
}

sourceSets.main.java.srcDirs = ['src/main/generated','src/main/java']
configurations {
    zipArchive

    all {
        resolutionStrategy {
            // for spotless transitive dependency CVE
            force "org.eclipse.platform:org.eclipse.core.runtime:3.29.0"
            force "com.google.guava:guava:32.1.3-jre"
        }
    }
}

dependencies {
    javaRestTestImplementation project.sourceSets.main.runtimeClasspath
    implementation group: 'org.apache.commons', name: 'commons-lang3', version: "${versions.commonslang}"
    compileOnly "org.antlr:antlr4-runtime:4.10.1"
    compileOnly "com.cronutils:cron-utils:9.1.7"
    compileOnly "org.opensearch:common-utils:${common_utils_version}@jar"
    compileOnly "org.opensearch.client:opensearch-rest-client:${opensearch_version}"
    compileOnly "org.jetbrains.kotlin:kotlin-stdlib:${kotlin_version}"
    compileOnly "org.opensearch:opensearch-job-scheduler-spi:${opensearch_build}"
    compileOnly "org.opensearch.alerting:alerting-spi:${alerting_spi_build}"
    implementation "org.apache.commons:commons-csv:1.10.0"
    compileOnly "com.google.guava:guava:32.1.3-jre"

    // TODO uncomment once SA commons is published to maven central
//    api "org.opensearch:security-analytics-commons:${sa_commons_version}@jar"

    // TODO remove once SA commons is published to maven central
    api files(sa_commons_file_path)

    // Needed for integ tests
    zipArchive group: 'org.opensearch.plugin', name:'alerting', version: "${opensearch_build}"
    zipArchive group: 'org.opensearch.plugin', name:'opensearch-notifications-core', version: "${opensearch_build}"
    zipArchive group: 'org.opensearch.plugin', name:'notifications', version: "${opensearch_build}"
    zipArchive group: 'org.opensearch.plugin', name:'opensearch-job-scheduler', version: "${opensearch_build}"
    testImplementation 'org.junit.jupiter:junit-jupiter-api:5.8.1'
}

// RPM & Debian build
apply plugin: 'com.netflix.nebula.ospackage'

def es_tmp_dir = rootProject.file('build/private/es_tmp').absoluteFile
es_tmp_dir.mkdirs()

File repo = file("$buildDir/testclusters/repo")
def _numNodes = findProperty('numNodes') as Integer ?: 1

def opensearch_tmp_dir = rootProject.file('build/private/opensearch_tmp').absoluteFile
opensearch_tmp_dir.mkdirs()

task integTest(type: RestIntegTestTask) {
    description = "Run tests against a cluster"
    testClassesDirs = sourceSets.test.output.classesDirs
    classpath = sourceSets.test.runtimeClasspath
}
tasks.named("check").configure { dependsOn(integTest) }

integTest {
    if (project.hasProperty('excludeTests')) {
        project.properties['excludeTests']?.replaceAll('\\s', '')?.split('[,;]')?.each {
            exclude "${it}"
        }
    }
    systemProperty 'tests.security.manager', 'false'
    systemProperty 'java.io.tmpdir', es_tmp_dir.absolutePath

    systemProperty "https", System.getProperty("https")
    systemProperty "user", System.getProperty("user")
    systemProperty "password", System.getProperty("password")

    if (System.getProperty("https") == null || System.getProperty("https") == "false") {
        filter {
            excludeTestsMatching "org.opensearch.securityanalytics.resthandler.Secure*RestApiIT"
            excludeTestsMatching "org.opensearch.securityanalytics.findings.Secure*RestApiIT"
            excludeTestsMatching "org.opensearch.securityanalytics.alerts.Secure*RestApiIT"
        }
    }

    if (System.getProperty("https") != null || System.getProperty("https") == "true") {
        filter {
            excludeTestsMatching "org.opensearch.securityanalytics.*TransportIT"
        }
    }

    // Tell the test JVM if the cluster JVM is running under a debugger so that tests can use longer timeouts for
    // requests. The 'doFirst' delays reading the debug setting on the cluster till execution time.
    doFirst {
        // Tell the test JVM if the cluster JVM is running under a debugger so that tests can
        // use longer timeouts for requests.
        def isDebuggingCluster = getDebug() || System.getProperty("test.debug") != null
        systemProperty 'cluster.debug', isDebuggingCluster
        // Set number of nodes system property to be used in tests
        systemProperty 'cluster.number_of_nodes', "${_numNodes}"
        // There seems to be an issue when running multi node run or integ tasks with unicast_hosts
        // not being written, the waitForAllConditions ensures it's written
        getClusters().forEach { cluster ->
            cluster.waitForAllConditions()
        }
    }

    // The -Dcluster.debug option makes the cluster debuggable; this makes the tests debuggable
    if (System.getProperty("test.debug") != null) {
        jvmArgs '-agentlib:jdwp=transport=dt_socket,server=n,suspend=y,address=8000'
    }
}
Zip bundle = (Zip) project.getTasks().getByName("bundlePlugin");
integTest.dependsOn(bundle)
integTest.getClusters().forEach{c -> {
    c.plugin(project.getObjects().fileProperty().value(bundle.getArchiveFile()))
}}

testClusters.integTest {
    testDistribution = 'ARCHIVE'

    // Cluster shrink exception thrown if we try to set numberOfNodes to 1, so only apply if > 1
    if (_numNodes > 1) numberOfNodes = _numNodes
    // When running integration tests it doesn't forward the --debug-jvm to the cluster anymore
    // i.e. we have to use a custom property to flag when we want to debug OpenSearch JVM
    // since we also support multi node integration tests we increase debugPort per node
    if (System.getProperty("cluster.debug") != null) {
        def debugPort = 5005
        nodes.forEach { node ->
            node.jvmArgs("-agentlib:jdwp=transport=dt_socket,server=n,suspend=y,address=*:${debugPort}")
            debugPort += 1
        }
    }
    plugin(provider({
        new RegularFile() {
            @Override
            File getAsFile() {
                return configurations.zipArchive.asFileTree.matching {
                    include '**/opensearch-notifications-core*'
                }.singleFile
            }
        }
    }))
    plugin(provider({
        new RegularFile() {
            @Override
            File getAsFile() {
                return configurations.zipArchive.asFileTree.matching {
                    include '**/notifications*'
                }.singleFile
            }
        }
    }))
    plugin(provider({
        new RegularFile() {
            @Override
            File getAsFile() {
                return configurations.zipArchive.asFileTree.matching {
                    include '**/alerting*'
                }.singleFile
            }
        }
    }))
    plugin(provider({
        new RegularFile() {
            @Override
            File getAsFile() {
                return configurations.zipArchive.asFileTree.matching {
                    include '**/opensearch-job-scheduler*'
                }.singleFile
            }
        }
    }))
    nodes.each { node ->
        def plugins = node.plugins
        def firstPlugin = plugins.get(0)
        plugins.remove(0)
        plugins.add(firstPlugin)
    }
}
def usingRemoteCluster = System.properties.containsKey('tests.rest.cluster') || System.properties.containsKey('tests.cluster')
def usingMultiNode = project.properties.containsKey('numNodes')
if (!usingRemoteCluster && !usingMultiNode) {
    apply from: 'build-tools/opensearchplugin-coverage.gradle'
}

run {
    doFirst {
        // There seems to be an issue when running multi node run or integ tasks with unicast_hosts
        // not being written, the waitForAllConditions ensures it's written
        getClusters().forEach { cluster ->
            cluster.waitForAllConditions()
        }
    }
    useCluster testClusters.integTest
}

task integTestRemote(type: RestIntegTestTask) {
    testClassesDirs = sourceSets.test.output.classesDirs
    classpath = sourceSets.test.runtimeClasspath
    systemProperty 'tests.security.manager', 'false'
    systemProperty 'java.io.tmpdir', opensearch_tmp_dir.absolutePath

    systemProperty "https", System.getProperty("https")
    systemProperty "user", System.getProperty("user")
    systemProperty "password", System.getProperty("password")

    if (System.getProperty("tests.rest.cluster") != null) {
        filter {
            includeTestsMatching "org.opensearch.securityanalytics.*RestApiIT"
        }
    }

    if (System.getProperty("https") == null || System.getProperty("https") == "false") {
        filter {
            excludeTestsMatching "org.opensearch.securityanalytics.resthandler.Secure*RestApiIT"
            excludeTestsMatching "org.opensearch.securityanalytics.findings.Secure*RestApiIT"
            excludeTestsMatching "org.opensearch.securityanalytics.alerts.Secure*RestApiIT"
        }
    }
}
integTestRemote.enabled = System.getProperty("tests.rest.cluster") != null

// This is afterEvaluate because the bundlePlugin ZIP task is updated afterEvaluate and changes the ZIP name to match the plugin name
afterEvaluate {
    ospackage {
        packageName = "${name}"
        release = isSnapshot ? "0.1" : '1'
        version = "${project.version}" - "-SNAPSHOT"

        into '/usr/share/opensearch/plugins'
        from(zipTree(bundlePlugin.archivePath)) {
            into opensearchplugin.name
        }

        // TODO remove once SA commons is published to maven central
        from(project.rootDir) {
            include sa_commons_file_name
            into opensearchplugin.name
        }

        user 'root'
        permissionGroup 'root'
        fileMode 0644
        dirMode 0755

        requires('opensearch', versions.opensearch, EQUAL)
        packager = 'Amazon'
        vendor = 'Amazon'
        os = 'LINUX'
        prefix '/usr'

        license 'ASL-2.0'
        maintainer 'OpenSearch Team <opensearch@amazon.com>'
        url 'https://opensearch.org/downloads.html'
        summary '''
         Security Analytics plugin for OpenSearch.
         Reference documentation can be found at https://docs-beta.opensearch.org/.
    '''.stripIndent().replace('\n', ' ').trim()
    }

    buildRpm {
        arch = 'NOARCH'
        dependsOn 'assemble'
        finalizedBy 'renameRpm'
        task renameRpm(type: Copy) {
            from("$buildDir/distributions")
            rename "$archiveFileName", "${packageName}-${archiveVersion}.rpm"
            doLast { delete file("$buildDir/distributions/$archiveFileName") }
        }
    }
    buildDeb {
        arch = 'all'
        dependsOn 'assemble'
        finalizedBy 'renameDeb'
        task renameDeb(type: Copy) {
            from("$buildDir/distributions")
            rename "$archiveFileName", "${packageName}-${archiveVersion}.deb"
            doLast { delete file("$buildDir/distributions/$archiveFileName") }
        }
    }
}