Skip to content
Open
Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
38 commits
Select commit Hold shift + click to select a range
ed4895a
chore: update Java version in Dockerfile and sdkmanrc to liberica
csikb Aug 26, 2025
e5883ee
chore: update Java version in Dockerfile and sdkmanrc to liberica
csikb Aug 26, 2025
420ee01
chore: update upload-artifact action to v4.6.2 in gradle.yml
csikb Aug 26, 2025
27e6762
chore: update upload-artifact action to v4.6.2 in gradle.yml
csikb Aug 26, 2025
96dc8c5
chore: update upload-artifact action to v4.6.2 in gradle.yml
csikb Aug 26, 2025
1806ace
Merge branch 'refs/heads/main' into gh-actions
csikb Aug 29, 2025
3542708
feat: add SonarQube plugin and configuration for code quality analysis
csikb Aug 29, 2025
7bf6e7e
fix: update gradle.yml to set fetch-depth for Git blame information
csikb Aug 29, 2025
58e244c
Merge branch 'main' into gh-actions
csikb Sep 16, 2025
eca713d
Update gradle.yml
csikb Sep 16, 2025
790cdb3
chore: update scorecard.yml for improved GitHub Actions integration
csikb Sep 16, 2025
c3aab6b
feat: add application configuration and initial test setup
csikb Sep 19, 2025
50095f5
Merge branch 'main' into gh-actions
csikb Sep 20, 2025
7a15f24
feat: upgrade to Java 25 and update Gradle wrapper to 9.1.0
csikb Sep 23, 2025
9875214
feat: update Kotlin dependencies to version 2.3.0
csikb Sep 23, 2025
373be78
Merge branch 'main' into jdk-25
csikb Sep 23, 2025
3ecfdd3
Merge branch 'main' into jdk-25
csikb Sep 29, 2025
4e60d29
Update .sdkmanrc
csikb Sep 29, 2025
0bd6b28
feat: update Kotlin dependencies to 2.3.0-dev-9673 and add bootstrap …
csikb Oct 4, 2025
a5acf33
Merge branch 'main' into jdk-25
csikb Oct 4, 2025
1d57787
chore: update Dockerfile to use specific image digest for build
csikb Oct 4, 2025
697da06
refactor: remove unnecessary whitespace in BssWebApplicationTest
csikb Oct 4, 2025
c0558a5
chore: update OpenJDK image version to 25.0 in config.yml
csikb Oct 4, 2025
b61e4ad
chore: update OpenJDK image version to 25.0 in config.yml
csikb Oct 4, 2025
05cb963
chore: reorganize Dockerfile and settings.gradle.kts for improved bui…
csikb Oct 4, 2025
d4031cc
Merge branch 'main' into gh-actions
csikb Oct 4, 2025
7b42750
chore: optimize Dockerfile with cache mounts for gradle builds
csikb Oct 4, 2025
3b7049d
Merge branch 'main' into gh-actions
csikb Oct 4, 2025
330e4e2
Merge branch 'main' into gh-actions
csikb Oct 4, 2025
817f6b7
Merge branch 'gh-actions' into jdk-25
csikb Oct 4, 2025
62bda84
chore: update Java version to 25 in gradle.yml and modify docker.yml …
csikb Oct 4, 2025
13df06e
chore: remove conditional platform setting from docker.yml
csikb Oct 4, 2025
858fbb5
Merge branch 'main' into jdk-25
csikb Nov 13, 2025
3e6b020
Update build.gradle.kts
csikb Nov 13, 2025
073755c
chore(deps): update Kotlin dependencies and Detekt version
csikb Nov 13, 2025
c792695
chore(deps): update Kotlin dependencies and Detekt version
csikb Nov 13, 2025
01743b5
chore(deps): update Kotlin dependencies and Detekt version
csikb Nov 13, 2025
ebfea61
chore(deps): update Kotlin dependencies and Detekt version
csikb Nov 13, 2025
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion .github/workflows/gradle.yml
Original file line number Diff line number Diff line change
Expand Up @@ -24,7 +24,7 @@ jobs:
- uses: actions/setup-java@dded0888837ed1f317902acf8a20df0ad188d165 # v5.0.0
with:
distribution: "liberica"
java-version: 21
java-version: 25
- uses: gradle/actions/setup-gradle@4d9f0ba0025fe599b4ebab900eb7f3a1d93ef4c2 # v5.0.0
with:
cache-encryption-key: ${{ secrets.GRADLE_ENCRYPTION_KEY }}
Expand Down
2 changes: 1 addition & 1 deletion .sdkmanrc
Original file line number Diff line number Diff line change
@@ -1,3 +1,3 @@
# Enable auto-env through the sdkman_auto_env config
# Add key=value pairs of SDKs to use below
java=21.0.8-librca
java=25-librca
2 changes: 1 addition & 1 deletion Dockerfile
Original file line number Diff line number Diff line change
@@ -1,4 +1,4 @@
FROM bellsoft/liberica-runtime-container:jdk-21.0.9_11-cds-musl@sha256:9fa29c32825076ee981ea9b9e73b84cc70d9ee5411bbad5f2881a97362c894f9 AS build
FROM bellsoft/liberica-runtime-container:jdk-25-cds-musl@sha256:450594440bb32b72f281e50626b629f1cc60caeb7796638bc570b9fab03e55ee AS build
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🔴 Critical

🧩 Analysis chain

Verify the Docker image hashes are correct.

The base images have been updated to JDK 25 with new SHA256 hashes. While Liberica Runtime Container (Liberica Lite with Alpaquita Linux) supports JDK 25 as an LTS version, the new hashes must be verified as authentic to prevent supply-chain risks.

Please confirm these hashes by running:

Also ensure that the application is tested and verified to work correctly with Java 25, as this is a major version upgrade from JDK 21.

Also applies to: 29-29


🏁 Script executed:

#!/bin/bash
# Description: Verify Docker image hashes for jdk-25 and jre-25 images
# Expected: SHA256 digest matches the pinned hashes in Dockerfile

# For build stage image (jdk-25-cds-musl)
docker pull bellsoft/liberica-runtime-container:jdk-25-cds-musl 2>&1 | grep "Digest:"

# For runtime stage image (jre-25-cds-musl)
docker pull bellsoft/liberica-runtime-container:jre-25-cds-musl 2>&1 | grep "Digest:"

Length of output: 0


🏁 Script executed:

#!/bin/bash
# Description: Query Docker Hub API for image digest information
# Alternative approach: use Docker Hub API to verify the image tags and their digests

# For jdk-25-cds-musl image
echo "=== Checking jdk-25-cds-musl ==="
curl -s "https://hub.docker.com/v2/repositories/bellsoft/liberica-runtime-container/tags/jdk-25-cds-musl/" | head -100

echo ""
echo "=== Checking jre-25-cds-musl ==="
curl -s "https://hub.docker.com/v2/repositories/bellsoft/liberica-runtime-container/tags/jre-25-cds-musl/" | head -100

Length of output: 2344


Update the jdk-25-cds-musl image hash—current hash does not match Docker Hub.

The jre-25-cds-musl hash is correct, but the jdk-25-cds-musl hash is invalid:

  • Dockerfile: 450594440bb32b72f281e50626b629f1cc60caeb7796638bc570b9fab03e55ee
  • Docker Hub: 3726c869b95563c00a642d52fc06afdc649ac3071cad160152846515597b6ab1

Update line 1 to use the correct hash. This will prevent build failures and supply-chain risks.

🧰 Tools
🪛 Checkov (3.2.334)

[low] 1-40: Ensure that HEALTHCHECK instructions have been added to container images

(CKV_DOCKER_2)

🤖 Prompt for AI Agents
In Dockerfile around lines 1 to 1, the FROM image uses an incorrect digest for
bellsoft/liberica-runtime-container:jdk-25-cds-musl; replace the existing
sha256:450594440bb32b72f281e50626b629f1cc60caeb7796638bc570b9fab03e55ee with the
correct digest
sha256:3726c869b95563c00a642d52fc06afdc649ac3071cad160152846515597b6ab1 so the
base image matches Docker Hub and avoids build failures and supply-chain risks.

WORKDIR /usr/src/app
# cache dependencies
COPY ./buildSrc/*.gradle.kts ./buildSrc/
Expand Down
18 changes: 13 additions & 5 deletions buildSrc/build.gradle.kts
Original file line number Diff line number Diff line change
Expand Up @@ -5,18 +5,26 @@ plugins {

repositories {
gradlePluginPortal()
// TODO: remove when detekt stable is in gradle plugin portal
maven {
// https://central.sonatype.org/publish/publish-portal-snapshots/#consuming-via-gradle
url = uri("https://central.sonatype.com/repository/maven-snapshots/")
content {
includeModule("io.gitlab.arturbosch.detekt", "detekt-gradle-plugin")
}
}
Comment on lines +8 to +15
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🔴 Critical

🧩 Analysis chain

Address snapshot repository non-determinism and add removal tracking.

The Sonatype Maven snapshots repository introduces a reproducibility and supply-chain risk:

  • Snapshot artifacts are mutable and can change without version bumps.
  • Builds on different dates may resolve different binaries, causing non-deterministic behavior.
  • The TODO comment lacks a clear removal criterion or issue reference.

Since this PR upgrades to JDK 25, verify whether detekt is now stable in the Gradle plugin portal and can replace this workaround. If it remains necessary, update the TODO to reference a specific issue and define clear removal criteria (e.g., "Remove when detekt X.Y+ is available in gradle plugin portal").


🌐 Web query:

Is detekt stable in the Gradle plugin portal (not snapshot)?

💡 Result:

Yes — detekt is published as stable releases on the Gradle Plugin Portal (not only snapshots). For example, the io.gitlab.arturbosch.detekt plugin shows stable versions (latest listed: 1.23.8). [1][2]

Sources:

  • Gradle Plugin Portal — io.gitlab.arturbosch.detekt plugin (shows released versions). [1]
  • detekt documentation (Gradle usage / released versions). [2]

Remove unnecessary snapshot repository workaround.

detekt is published as stable releases on the Gradle Plugin Portal (latest: 1.23.8), making the Sonatype Maven snapshots repository workaround unnecessary. This workaround introduces reproducibility and supply-chain risks through mutable snapshot artifacts.

Remove lines 8-15 from buildSrc/build.gradle.kts entirely—the stable detekt plugin is now available directly from the Gradle Plugin Portal.

🤖 Prompt for AI Agents
In buildSrc/build.gradle.kts around lines 8 to 15, the Sonatype Maven snapshots
repository block (the detekt snapshot workaround) is no longer needed because
detekt is available as a stable plugin on the Gradle Plugin Portal; remove lines
8-15 entirely (the maven { url =
"https://central.sonatype.com/repository/maven-snapshots/" ...
includeModule(...) } block) so the build uses the Gradle Plugin Portal only and
avoids mutable snapshot dependencies.

}

dependencies {
implementation(libs.plugin.springBoot)
implementation(libs.plugin.spotless)
implementation(libs.plugin.detekt)
implementation(kotlin("allopen", "2.2.21"))
implementation(kotlin("gradle-plugin", "2.2.21"))
implementation(libs.kotlin.allopen)
implementation(libs.kotlin.gradle.plugin)
// required for kotlin plugin jpa
implementation(kotlin("reflect", "2.2.21"))
implementation(kotlin("stdlib-jdk8", "2.2.21"))
implementation(kotlin("noarg", "2.2.21"))
implementation(libs.kotlin.reflect)
implementation(libs.kotlin.stdlib.jdk8)
implementation(libs.kotlin.noarg)
Comment on lines +22 to +27
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🔴 Critical

🧩 Analysis chain

CRITICAL: Verify version catalog definitions for Kotlin dependencies.

The code now references version catalog entries (libs.kotlin.*), but a previous review flagged that gradle/libs.versions.toml does not exist. If this file is still missing, the build will fail at dependency resolution time.

Verify that all five Kotlin library entries are properly defined in gradle/libs.versions.toml:

  • kotlin.allopen
  • kotlin.gradle-plugin
  • kotlin.reflect
  • kotlin.stdlib-jdk8
  • kotlin.noarg

🏁 Script executed:

#!/bin/bash
# Description: Verify that gradle/libs.versions.toml exists and defines all required Kotlin libraries

# Check if gradle/libs.versions.toml exists
if [ ! -f gradle/libs.versions.toml ]; then
  echo "ERROR: gradle/libs.versions.toml does not exist"
  exit 1
fi

# Search for required Kotlin library definitions
echo "Checking for required Kotlin library definitions:"
rg -c 'kotlin\.(allopen|gradle-plugin|reflect|stdlib-jdk8|noarg)' gradle/libs.versions.toml

Length of output: 47


🏁 Script executed:

#!/bin/bash
# Search for any version catalog files in the repository
echo "Looking for version catalog files (*.versions.toml or libs.versions.toml):"
fd -e "versions.toml" . 2>/dev/null || echo "No *.versions.toml files found"

# Also check for gradle directory structure
echo ""
echo "Gradle directory contents:"
ls -la gradle/ 2>/dev/null || echo "gradle/ directory not found"

# Check if gradle/libs.versions.toml is referenced anywhere else in build files
echo ""
echo "Searching for references to libs.versions.toml or version catalog:"
rg -i "libs\.versions|version.catalog" --type gradle --type kotlin 2>/dev/null | head -20 || echo "No references found"

Length of output: 420


}

gradlePlugin {
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -9,6 +9,9 @@ class DependencyManagementPlugin : Plugin<Project> {
override fun apply(project: Project) {
project.repositories {
mavenCentral()
maven {
url = project.uri("https://redirector.kotlinlang.org/maven/bootstrap")
}
}

project.dependencies {
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -15,7 +15,7 @@ class JavaConventionPlugin : Plugin<Project> {

project.extensions.configure(JavaPluginExtension::class) {
toolchain {
languageVersion.set(JavaLanguageVersion.of(21))
languageVersion.set(JavaLanguageVersion.of(25))
}
}

Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -15,7 +15,7 @@ class JavaLibraryConventionPlugin : Plugin<Project> {

project.extensions.configure(JavaPluginExtension::class) {
toolchain {
languageVersion.set(JavaLanguageVersion.of(21))
languageVersion.set(JavaLanguageVersion.of(25))
}
}

Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -16,7 +16,7 @@ class KotlinConventionPlugin : Plugin<Project> {
freeCompilerArgs = listOf("-Xjsr305=strict")
extraWarnings = true
allWarningsAsErrors = true
jvmTarget = org.jetbrains.kotlin.gradle.dsl.JvmTarget.JVM_21
jvmTarget = org.jetbrains.kotlin.gradle.dsl.JvmTarget.JVM_25
}
}
}
Expand Down
8 changes: 7 additions & 1 deletion gradle/libs.versions.toml
Original file line number Diff line number Diff line change
Expand Up @@ -3,7 +3,8 @@ springdoc = "2.8.14"
springBoot = "3.5.7"
kotest = "6.0.4"
spotless = "8.0.0"
detekt = "1.23.8"
detekt = "2.0.0-alpha.1"
kotlin = "2.3.0-Beta2"

[plugins]
spotless = { id = "com.diffplug.spotless", version.ref = "spotless" }
Expand All @@ -15,3 +16,8 @@ kotestAssertionsJson = { module = "io.kotest:kotest-assertions-json", version.re
plugin-springBoot = { module = "org.springframework.boot:spring-boot-gradle-plugin", version.ref = "springBoot" }
plugin-spotless = { module = "com.diffplug.spotless:spotless-plugin-gradle", version.ref = "spotless" }
plugin-detekt = { module = "io.gitlab.arturbosch.detekt:detekt-gradle-plugin", version.ref = "detekt" }
kotlin-allopen = { module = "org.jetbrains.kotlin:kotlin-allopen", version.ref = "kotlin" }
kotlin-gradle-plugin = { module = "org.jetbrains.kotlin:kotlin-gradle-plugin", version.ref = "kotlin" }
kotlin-reflect = { module = "org.jetbrains.kotlin:kotlin-reflect", version.ref = "kotlin" }
kotlin-stdlib-jdk8 = { module = "org.jetbrains.kotlin:kotlin-stdlib-jdk8", version.ref = "kotlin" }
kotlin-noarg = { module = "org.jetbrains.kotlin:kotlin-noarg", version.ref = "kotlin" }
5 changes: 5 additions & 0 deletions server/build.gradle.kts
Original file line number Diff line number Diff line change
Expand Up @@ -4,6 +4,7 @@ plugins {
id("hu.bsstudio.gradle.spotless-convention")
id("hu.bsstudio.gradle.kotlin-convention")
id("hu.bsstudio.gradle.spring-app-convention")
id("hu.bsstudio.gradle.test-convention")
`jacoco-report-aggregation`
`test-report-aggregation`
}
Expand All @@ -14,6 +15,10 @@ dependencies {
// todo these scopes were only supported by the spring gradle dependency management plugin
// annotationProcessor("org.springframework.boot:spring-boot-configuration-processor")
// developmentOnly("org.springframework.boot:spring-boot-devtools")
testImplementation("org.springframework.boot:spring-boot-testcontainers")
testImplementation("org.testcontainers:testcontainers")
testImplementation("org.testcontainers:postgresql")
testImplementation("org.testcontainers:junit-jupiter")
}

tasks.test {
Expand Down
Original file line number Diff line number Diff line change
@@ -0,0 +1,11 @@
package hu.bsstudio.bssweb

import org.junit.jupiter.api.Test
import org.springframework.boot.test.context.SpringBootTest

@SpringBootTest
class BssWebApplicationTest {
@Test
fun contextLoads() {
}
}
13 changes: 13 additions & 0 deletions server/src/test/resources/application.yml
Original file line number Diff line number Diff line change
@@ -0,0 +1,13 @@
bss:
file-api:
url: http://localhost:8888
spring:
datasource:
url: jdbc:tc:postgresql:16.3-alpine3.18:///db?currentSchema=private
security:
oauth2:
resourceserver:
opaquetoken:
introspection-uri: http://localhost:8888
client-id: client-id
client-secret: client-secret
1 change: 1 addition & 0 deletions settings.gradle.kts
Original file line number Diff line number Diff line change
@@ -1,4 +1,5 @@
rootProject.name = "bss-web-admin-backend"

include(
"client",
"integration",
Expand Down
Loading