build.gradle

/**
 * Copyright (c) 2022 Partners In Health.  All rights reserved.
 * The use and distribution terms for this software are covered by the
 * Eclipse Public License 1.0 (http://opensource.org/licenses/eclipse-1.0.php)
 * which can be found in the file epl-v10.html at the root of this distribution.
 * By using this software in any fashion, you are agreeing to be bound by
 * the terms of this license.
 * You must not remove this notice, or any other, from this software.
 */

import java.time.LocalDateTime
import java.time.format.DateTimeFormatter

/**
 * Return the value of the ORG_GRADLE_PROJECT_WEB_SERVER environment variable, if set.
 *
 * We support 'jetty' (Jetty 9) and 'tomcat' (Tomcat 8.5-9.x).
 *
 * If the env. var is not set, we embed a Tomcat server in the war file.
 */
String targetWebServer() {
    return project.hasProperty('WEB_SERVER') ? project.getProperty('WEB_SERVER') : null
}

buildscript {
    configurations.configureEach {
        /*
         * The gradle-git-properties plugin pulls in JGit 6.x, which
         * requires Java 11+; for our builds to succeed we need 5.x.
         *
         * See https://github.com/n0mer/gradle-git-properties/issues/195
         */
        resolutionStrategy.force 'org.eclipse.jgit:org.eclipse.jgit:5.13.1.202206130422-r'
    }
    dependencies {
        classpath "com.bertramlabs.plugins:asset-pipeline-gradle:${assetPipelineVersion}"
        classpath "org.grails:grails-gradle-plugin:${grailsVersion}"
        classpath "org.grails.plugins:database-migration:${databaseMigrationVersion}"
        classpath "org.grails.plugins:views-gradle:${grailsViewsVersion}"
        classpath "org.owasp:dependency-check-gradle:${owaspVersion}"
    }
    repositories {
        mavenCentral()
        maven { url 'https://repo.grails.org/grails/core' }
    }
}

plugins {
    // enable the top-level `mainClassName` field
    id 'application'

    id 'eclipse'
    id 'groovy'
    id 'idea'

    // expose `pom` object, https://docs.gradle.org/4.10.3/userguide/maven_plugin.html
    id 'maven'

    // enable `grails gradle dependencyReport`, etc.
    id 'project-report'

    id 'war'

    // find outdated dependencies with `grails gradle dependencyUpdates`
    id 'com.github.ben-manes.versions' version '0.27.0'

    // git magic, but releases past v2.3.0 require Gradle 5.1+
    id 'com.gorylenko.gradle-git-properties' version '2.2.4'

    // enable `npmInstall` and `npm_run_*` targets, and the `node` block below
    id 'com.github.node-gradle.node' version '1.5.3'

    // resolve a Windows-specific build issue
    id 'com.virgo47.ClasspathJar' version '1.0.0'

    // enable `grails gradle autoLintGradle`
    id 'nebula.lint' version '17.8.0'
}

// prevent warfile issues by applying this before `asset-pipeline`. OBGM-353
apply plugin: 'org.grails.grails-web'

apply plugin: 'asset-pipeline'  // enable `assets` block, but see deps below

// prevent warfile issues by applying this after `asset-pipeline`. OBGM-353
apply plugin: 'org.grails.grails-gsp'

/*
 * This plugin must load *after* the core grails/gradle plugins.
 * http://views.grails.org/latest/#_installation
 */
apply plugin: 'org.grails.plugins.views-json'

// enable `grails gradle dependencyCheckAnalyze` (security checker)
apply plugin: 'org.owasp.dependencycheck'

group 'com.openboxes'
mainClassName = 'org.pih.warehouse.Application'
sourceCompatibility = 1.8
targetCompatibility = 1.8

/*
 * From the asset-pipeline manual: "If you want settings to apply to
 * both development runtime and build time the properties have to be
 * duplicated in your application's application.yml [and build.gradle]."
 *
 * http://www.asset-pipeline.com/manual/index.html#configuration
 * http://www.asset-pipeline.com/manual/index.html#configuration-2
 *
 * Because we use webpack to bundle .css and .js files, most of
 * asset-pipeline's advanced features are unnecessary.
 */
assets {
    developmentRuntime = false
    enableDigests = false
    enableGzip = false
    enableSourceMaps = false
    maxThreads = 1
    minifyJs = false
    minifyCss = false
    skipNonDigests = false
}

bootRun {
    addResources = true
    dependsOn 'npm_run_bundle'
    jvmArgs = [
        '-Dspring.output.ansi.enabled=never',
        '-Xdebug',
        '-Xrunjdwp:transport=dt_socket,server=y,suspend=n,address=5005'
    ]
    systemProperties System.properties
}

configurations {
    configureEach {
        // log4j-over-slf4j exposes the same API as this fork of log4j 1.x does
        exclude group: 'ch.qos.reload4j', module: 'reload4j'

        // use com.github.librepdf:openpdf instead
        exclude group: 'com.lowagie', module: 'itext'

        // these API's have moved to jakarta.activation:jakarta.activation-api
        exclude group: 'com.sun.activation', module: 'jakarta.activation'
        exclude group: 'javax.activation', module: 'activation'

        // superseded by com.sun.mail:jakarta.mail
        exclude group: 'com.sun.mail', module: 'javax.mail'

        // jcl-over-slf4j exposes the same API as commons-logging
        exclude group: 'commons-logging', module: 'commons-logging'

        // relocated to `org.dom4j:dom4j` with Java 8 support
        exclude group: 'dom4j', module: 'dom4j'

        // presented by spring-boot-starter-jetty and spring-boot-starter-tomcat
        exclude group: 'javax.annotation', module: 'javax.annotation-api'
        exclude group: 'javax.el', module: 'javax.el-api'

        /*
         * The same API is provided by a transitive dependency of Hibernate
         * (org.jboss.spec.javax.transaction:jboss-transaction-api_1.2_spec).
         */
        exclude group: 'javax.transaction', module: 'jta'

        // superseded by jakarta.xml.bind:jakarta.xml.bind-api
        exclude group: 'javax.xml.bind', module: 'jaxb-api'

        // log4j-over-slf4j exposes the same API as log4j 1.x
        exclude group: 'log4j', module: 'log4j'

        // log4j-to-slf4j exposes the same API as log4j 2.x
        exclude group: 'org.apache.logging.log4j', module: 'log4j'

        // presented by spring-boot-starter-jetty and spring-boot-starter-tomcat
        exclude group: 'org.apache.tomcat', module: 'tomcat-juli'

        // this API moved to tomcat-core after 8.5.2
        exclude group: 'org.apache.tomcat.embed', module: 'tomcat-embed-logging-log4j'

        /*
         * The `asset-pipeline` has moved to com.bertramlabs.plugins.
         * Ignore requests for the out-of-date version.
         * See https://github.com/bertramdev/asset-pipeline/issues/247#issuecomment-649594531
         */
        exclude group: 'org.grails.plugins', module: 'asset-pipeline'

        // superseded by org.xhtmlrenderer:flying-saucer-core
        exclude group: 'org.xhtmlrenderer', module: 'core-renderer'

        resolutionStrategy {
            /*
             * Fail-fast if Gradle pulls in multiple versions of one
             * dependency, which can cause deployment problems. Note,
             * this won't differently-named modules that export the
             * same API, which also can break the build. Fortunately,
             * API collisions are less common than version collisions.
             */
            failOnVersionConflict()

            /*
             * A number of our dependencies comprise tightly coupled module
             * groups. A straightforward way to prevent intra-dependency
             * version skew is to apply useVersion() on a group-wide basis.
             */
            eachDependency { DependencyResolveDetails details ->

                if (details.requested.group == 'ch.qos.logback') {
                    details.because 'use a consistent logback version'
                    details.useVersion(logbackVersion)
                }

                if (details.requested.group.startsWith('com.fasterxml.jackson')) {
                    details.because 'enforce consistent Jackson versioning'
                    if (details.requested.name == 'jackson-databind') {
                        // one module has a series of 8(!) security hotfixes
                        details.useVersion(jacksonVersion + '.8')
                    } else {
                        details.useVersion(jacksonVersion)
                    }
                }

                if (details.requested.group == 'org.apache.httpcomponents') {
                    details.because 'enforce consistent httpcomponents versioning'
                    if (details.requested.name == 'httpcore') {
                        details.useVersion(httpCoreVersion)
                    } else {
                        details.useVersion(httpComponentsVersion)
                    }
                }

                if (details.requested.group.startsWith('org.apache.tomcat')) {
                    details.because 'enforce consistent Tomcat versioning'
                    details.useVersion(tomcatVersion)
                }

                if (details.requested.group == 'org.apache.xmlgraphics') {
                    details.because 'apply batik security patches'
                    if (details.requested.name.startsWith('batik')) {
                        details.useVersion(batikVersion)
                    }
                }

                if (details.requested.group == 'org.ow2.asm') {
                    details.because 'enforce a consistent, Java-8 compatible ASM release'
                    details.useVersion(asmVersion)
                }

                if (details.requested.group == 'org.codehaus.groovy') {
                    details.because 'enforce consistent Groovy versioning'
                    details.useVersion(groovyVersion)
                }

                if (details.requested.group == 'org.docx4j') {
                    details.because 'enforce consistent docx4j versioning'
                    details.useVersion(docx4jVersion)
                }

                if (details.requested.group == 'org.hibernate') {
                    if (details.requested.name != 'hibernate-validator') {
                        details.because 'enforce consistent hibernate versioning'
                        details.useVersion(hibernateVersion)
                    }
                }

                if (details.requested.group == 'org.seleniumhq.selenium') {
                    if (details.requested.name.startsWith('selenium-')) {
                        details.because 'enforce consistent Selenium versioning'
                        details.useVersion(seleniumVersion)
                    }
                }

                if (details.requested.group == 'org.slf4j') {
                    details.because 'enforce consistent slf4j versioning'
                    details.useVersion(slf4jVersion)
                }

                if (details.requested.group == 'org.springframework') {
                    if (details.requested.name != 'springloaded') {
                        details.because 'enforce consistent Spring versioning'
                        details.useVersion(springframeworkVersion)
                    }
                }
            }

            /*
             * We can use `force` to ensure consistent sub-(sub-)dependency
             * versions, and/or to apply security patches to packages we
             * wouldn't mark in the `dependencies` block because we don't
             * consume their API's directly.
             */
            force 'com.google.errorprone:error_prone_annotations:2.19.1'  // use consistent version
            force 'com.google.protobuf:protobuf-java:3.21.11'  // security patch
            force 'commons-io:commons-io:2.12.0'  // security patch
            force 'commons-validator:commons-validator:1.7'  // security patch
            force 'jline:jline:2.14.6'  // use consistent version
            force 'org.apache.commons:commons-lang3:3.12.0'  // security patch
            force 'org.apache.xmlgraphics:xmlgraphics-commons:2.8'  // use consistent version
            force 'org.apache.xmlbeans:xmlbeans:3.1.0'  // security patch, build fixes
            force 'org.checkerframework:checker-qual:3.12.0'  // use consistent version
            force 'org.dom4j:dom4j:2.1.4'  // security patch
            force 'org.objenesis:objenesis:2.1'  // openjdk support
        }
    }
}

configurations.integrationTestImplementation {
    extendsFrom(configurations.implementation)
}

// app servers, other than jetty, expose this api directly
if (targetWebServer() != 'jetty') {
    configurations.configureEach {
        exclude group: 'javax.servlet', module: 'javax.servlet-api'
    }
}

dependencyCheckAnalyze.dependsOn 'npm_run_bundle'
dependencyCheck {
    analyzers {
        assemblyEnabled = false
        nodeAudit {
            enabled = true
            skipDevDependencies = true
            yarnEnabled = false  // we use npm exclusively
        }
        retirejs.enabled = true
    }

    autoUpdate = true
    failBuildOnCVSS = 11
    format = 'ALL'
    junitFailOnCVSS = 11
    skipTestGroups = true
}

gradleLint {
    alwaysRun = false
    rules = [
        'all-dependency',
        'archaic-wrapper',
        'duplicate-dependency-class',
        'overridden-dependency-version',
    ]
    excludedRules = ['unused-exclude-by-dep']
}

manifest {
    attributes(
        'Main-Class': project.mainClassName,
        'Implementation-Version': project.version.toString()
    )
}

node {
    distBaseUrl = 'https://nodejs.org/dist'
    download = true
    npmVersion = '6.14.18'
    version = '14.21.3'
}

processResources {
    dependsOn 'npm_run_bundle'
}

repositories {
    mavenCentral()
    maven { url 'https://repo.grails.org/grails/core' }
    // deprecated; only used to fetch code-coverage plugin
    maven { url 'https://repo.grails.org/grails/plugins' }
    maven { url 'https://jitpack.io' }
}

/*
 * Add migrations to `sourceSets` *before* introducing liquibase dependencies.
 *
 * See https://grails.github.io/grails-database-migration/3.1.0/index.html
 */
sourceSets {
    main {
        resources {
            srcDir 'grails-app/migrations'
        }
    }
}

springBoot {
    buildInfo()
    mainClass = 'org.pih.warehouse.Application'
    executable = true
}

war {
    archiveName = 'openboxes.war'
    zip64 = true
}

dependencies {
    /*
     * Tomcat provides many libraries out of the box, while Grails, by
     * default, embeds (some) (old) Tomcat dependencies within its war
     * files so they can run in a standalone context (we make use of
     * this in openboxes-devops/arm-template/scripts/ob-vm-setup.sh).
     * When deploying to a Tomcat container, we should use `provided`,
     * per Grails 3's deployment guide, to leverage the web server.
     *
     * https://tomcat.apache.org/tomcat-8.5-doc/RELEASE-NOTES.txt
     * http://docs.grails.org/3.3.16/guide/deployment.html
     *
     * This ticket has a good discussion of `provided` gotchas.
     * https://github.com/grails/grails-core/issues/10483
     *
     * We can't wrap this logic in a function call because 'compile' and
     * 'provided' are magic words that only work in a 'dependency' block.
     */
    if (targetWebServer() == 'tomcat') {
        logger.quiet 'configuring for a Tomcat-hosted environment...'
        provided "org.apache.tomcat:tomcat-jdbc:${tomcatVersion}"
        provided 'org.springframework.boot:spring-boot-starter-tomcat'
    } else if (targetWebServer() == 'jetty') {
        logger.quiet 'configuring for a Jetty-hosted environment...'
        provided "javax.servlet:javax.servlet-api:${servletVersion}"
        compile "org.apache.tomcat:tomcat-jdbc:${tomcatVersion}"
        provided 'org.springframework.boot:spring-boot-starter-jetty'
    } else {
        logger.quiet 'configuring for a standalone environment...'
        compile "org.apache.tomcat:tomcat-jdbc:${tomcatVersion}"
        compile 'org.springframework.boot:spring-boot-starter-tomcat'
    }

    implementation 'ch.qos.logback:logback-classic'
    implementation 'ch.qos.logback:logback-core'

    /*
     * Manage static assets in the grails-app/assets/ directory.
     *
     * See https://github.com/bertramdev/asset-pipeline#documentation-1
     */
    runtime "com.bertramlabs.plugins:asset-pipeline-grails:${assetPipelineVersion}"

    implementation "com.github.librepdf:openpdf:${openPdfVersion}"

    // security patch
    compile 'com.google.code.gson:gson:2.10.1'

    // expose javax.annotation.Nullable, com.google.common.base.Enums, etc.
    compile 'com.google.guava:guava:32.0.1-jre'

    compile 'com.google.zxing:javase:3.5.1'  // barcode support

    testImplementation 'com.icegreen:greenmail:1.6.14'

    compile 'com.newrelic.agent.java:newrelic-api:8.2.0'

    implementation 'com.sun.mail:jakarta.mail:1.6.7'

    compile 'commons-beanutils:commons-beanutils:1.9.4'

    compile 'commons-codec:commons-codec:1.15'

    // FIXME migrate code under our control to commons-collections4
    implementation 'org.apache.commons:commons-collections4:4.4'
    implementation 'commons-collections:commons-collections:3.2.2'

    compile 'commons-fileupload:commons-fileupload:1.5'

    compile 'commons-lang:commons-lang:2.6'  // FIXME migrate to commons-lang3

    implementation "fr.opensagres.xdocreport:fr.opensagres.xdocreport.converter.docx.docx4j:${xDocReportVersion}"
    implementation "fr.opensagres.xdocreport:fr.opensagres.xdocreport.document:${xDocReportVersion}"
    implementation "fr.opensagres.xdocreport:fr.opensagres.xdocreport.template:${xDocReportVersion}"
    implementation "fr.opensagres.xdocreport:fr.opensagres.xdocreport.converter:${xDocReportVersion}"
    implementation("fr.opensagres.xdocreport:fr.opensagres.xdocreport.converter.docx.xwpf:${xDocReportVersion}") {
        exclude group: "org.apache.poi", module: "poi-ooxml"
    }
    implementation "fr.opensagres.xdocreport:fr.opensagres.xdocreport.converter.odt.odfdom:${xDocReportVersion}"
    implementation "fr.opensagres.xdocreport:fr.opensagres.xdocreport.document.docx:${xDocReportVersion}"
    implementation "fr.opensagres.xdocreport:fr.opensagres.xdocreport.document.odt:${xDocReportVersion}"
    implementation "fr.opensagres.xdocreport:fr.opensagres.xdocreport.template.freemarker:${xDocReportVersion}"
    implementation "fr.opensagres.xdocreport:fr.opensagres.xdocreport.template.velocity:${xDocReportVersion}"

    implementation 'fr.w3blog:zebra-zpl:0.0.4'  // ZebraUtils.printZpl(), Labelary API, etc.

    /*
     * FIXME Used in only one place: ApiControllerFunctionalSpec.groovy.
     * FIXME Use apache's httpclient instead.
     */
    testCompile 'io.micronaut:micronaut-http-client:1.2.11'

    implementation "io.sentry:sentry:${sentryVersion}"
    implementation "io.sentry:sentry-logback:${sentryVersion}"
    implementation "io.sentry:sentry-servlet:${sentryVersion}"

    // incorporate latest timezone changes
    implementation 'joda-time:joda-time:2.12.5'

    testCompile 'junit:junit:4.13.2'

    // Database jdbc connectors (Connector/J)
    compile "mysql:mysql-connector-java:${mySqlConnectorVersion}"
    implementation 'org.mariadb.jdbc:mariadb-java-client'

    testRuntime "net.sourceforge.htmlunit:htmlunit:${htmlUnitVersion}"

    implementation 'org.apache.commons:commons-csv:1.10.0'
    compile 'org.apache.commons:commons-email:1.5'

    implementation 'org.apache.httpcomponents:fluent-hc'
    implementation 'org.apache.httpcomponents:httpclient'

    // log4j2 -> slf4j; cf. log4j-to-slf4j
    implementation "org.apache.logging.log4j:log4j-api:${slf4jProvidedLog4j2Version}"
    implementation "org.apache.logging.log4j:log4j-to-slf4j:${slf4jProvidedLog4j2Version}"

    implementation "org.apache.poi:poi:${poiVersion}"

    // enable `import groovyx.gpars.GParsPool`, but consider grails-async-gpars?
    implementation 'org.codehaus.gpars:gpars:1.2.1'

    // enable `import groovy.sql.Sql`
    implementation 'org.codehaus.groovy:groovy-sql'

    compile 'org.docx4j:docx4j-JAXB-ReferenceImpl'

    // enable grails console web ui
    console 'org.grails:grails-console'

    implementation 'org.grails.plugins:grails-console:2.1.1'

    /*
     * Enable unit tests of domain activity; see
     * https://testing.grails.org/1.1.5/guide/index.html
     */
    testCompile 'org.grails:grails-gorm-testing-support'

    // set up grails log framework (logback under the hood)
    implementation 'org.grails:grails-logging'

    // prevent `java.lang.NullPointerException: Cannot invoke method registerStructuredEditor() on null object`
    compile 'org.grails:grails-plugin-databinding'

    // prevent `java.lang.ClassNotFoundException: grails.artefact.Interceptor`
    compile 'org.grails:grails-plugin-interceptors'

    // enable `import grails.converters.JSON`
    compile 'org.grails:grails-plugin-rest'

    // prevent Grails from thinking services are broken Domain objects
    compile 'org.grails:grails-plugin-services'

    /*
     * Deprecated: use https://github.com/grails/grails-testing-support
     *
     * FIXME Refactor instances of, e.g., `import grails.test.mixin`.
     *
     * See https://testing.grails.org/latest/guide/index.html#upgrading
     */
    testCompile('org.grails:grails-test-mixins:3.3.0') {
        /*
         * Old; relocated to `org.ow2.asm:asm`, which we pull in
         * via `org.springframework.boot:spring-boot-starter-test`.
         */
        exclude group: 'asm', module: 'asm'
        // prevent requests for ancient versions of sub-dependencies
        exclude group: 'org.grails', module: 'grails-web-jsp'
        exclude group: 'org.objenesis', module: 'objenesis'
    }

    compile 'org.grails:grails-web-boot'

    /*
     * Enable `import grails.testing.web.controllers.ControllerUnitTest`.
     * Using `testCompile` prevents integrationTestCompileClasspath warnings.
     */
    testCompile 'org.grails:grails-web-testing-support'

    /*
     * <g:formRemote> and <g:remoteLink> were deprecated in Grails 3.0:
     *
     * http://docs.grails.org/3.0.x/ref/Tags/formRemote.html
     *
     * They no longer appear in the 3.1 documentation. This plugin gives
     * them an additional lease on life, although leaving it out doesn't
     * seem to break anything.
     */
    compile 'org.grails.plugins:ajax-tags:1.0.0'

    // prevent java.lang.ClassNotFoundException for a few classes we don't directly consume
    implementation 'org.grails.plugins:async'

    /*
     * Enable userAgentIdentService.isMobile() and <browser:is*> tags.
     *
     * Integration tests break messily if this is set to `implementation`.
     */
    compile 'org.grails.plugins:browser-detection:3.4.0'

    // enable `import grails.plugin.cache.Cacheable`
    implementation 'org.grails.plugins:cache:4.0.3'
    compile 'org.grails.plugins:cache-ehcache:3.0.0'

    // enable `grails test-app -coverage`
    testImplementation('org.grails.plugins:code-coverage:2.0.3-3') {
        // last updated in 2016, this plugin pulls in 10+year-old dependencies
        exclude group: 'org.apache.ant'  // not needed for gradle builds
        exclude group: 'org.mortbay.jetty'  // superseded by org.eclipse.jetty
        exclude group: 'xalan'
        exclude group: 'xerces'
    }

    // FIXME use commons-csv instead
    implementation 'org.grails.plugins:csv:1.0.1'

    // enable liquibase migrations
    compile("org.grails.plugins:database-migration:${databaseMigrationVersion}") {
        exclude group: 'com.h2database', module: 'h2'
    }

    // FIXME use commons-csv instead
    implementation 'org.grails.plugins:excel-import:3.0.2'

    // load config via files listed in application.yml::grails.config.locations
    implementation 'org.grails.plugins:external-config:1.4.0'

    // enable `import geb.*`
    testCompile 'org.grails.plugins:geb'

    // enable prettytime.display(), which we use only three times
    implementation 'org.grails.plugins:grails-pretty-time:4.0.0'

    // enable `import org.grails.plugins.web.taglib.*`
    compile 'org.grails.plugins:gsp'

    // prevent `No GORM implementations configured. Ensure GORM has been initialized correctly`
    compile("org.grails.plugins:hibernate5:${gormVersion-'.RELEASE'}") {
        exclude group: 'com.h2database', module: 'h2'
    }

    // use a release optimized for Grails 3.3.x for this `excel-import` sub-dependency
    implementation 'org.grails.plugins:joda-time:2.1.0'

    // enable `import grails.plugins.quartz.Job*`
    compile('org.grails.plugins:quartz:2.0.13') {
        transitive = false  // we pull in quartz-scheduler directly, below
    }

    // list all scheduled jobs at e.g. http://localhost:8080/openboxes/quartz
    compile('org.grails.plugins:quartz-monitor:1.3') {
        // will pull in old asset-pipeline and quartz dependencies otherwise
        transitive = false
    }

    /*
     * FIXME Stop using grails.plugins.rendering.pdf.PdfRenderingService.
     *
     * Need `compile` here to pick up trans. deps. like RenderingTrait.
     *
     * This plugin has an undeclared dependency on spring-test, q.v.
     */
    compile 'org.grails.plugins:rendering:2.0.3'

    // enable `static scaffold` declarations
    compile 'org.grails.plugins:scaffolding'

    /*
     * These plugins enable grails-app/views/*.gson files. I don't think
     * we use this functionality, but they are included by this command:
     *
     * $ grails create-app openboxes --profile react-webpack
     *
     * See http://views.grails.org/1.2.10/
     */
    compile 'org.grails.plugins:views-json-templates'
    compile 'org.grails.plugins:views-json'

    profile 'org.grails.profiles:react-webpack'

    // enable `import org.hibernate.tool.schema.TargetType`, etc.
    compile "org.hibernate:hibernate-core:${hibernateVersion}"
    runtime "org.hibernate:hibernate-ehcache:${hibernateVersion}"
    testImplementation "org.hibernate:hibernate-testing:${hibernateVersion}"

    // joda-time support for hibernate
    implementation 'org.jadira.usertype:usertype.jodatime:2.0.1'

    // used in only one place: DocumentTemplateService.groovy for Customer Invoice Template
    implementation 'org.jxls:jxls:2.12.0'
    implementation('org.jxls:jxls-poi:1.0.14') {
        exclude group: 'org.jxls', module: 'jxls'
    }

    // strict dependency of database-migration plugin; see gradle.properties
    compile "org.liquibase:liquibase-core:${liquibaseVersion}"

    // enable `import org.quartz.*`
    compile('org.quartz-scheduler:quartz:2.3.2') {
        /*
         * We currently use tomcat-jdbc, but Quartz pulls in these two
         * alternative pooling libraries. If we see connection issues
         * in Grails 3, we may want to switch to one of these.
         */
        exclude group: 'com.mchange'
        exclude group: 'com.zaxxer'
    }

    testRuntime "org.seleniumhq.selenium:htmlunit-driver:${htmlUnitVersion}"

    testCompile 'org.seleniumhq.selenium:selenium-api'
    testRuntime 'org.seleniumhq.selenium:selenium-chrome-driver'
    testRuntime 'org.seleniumhq.selenium:selenium-edge-driver'
    testRuntime 'org.seleniumhq.selenium:selenium-ie-driver'
    testRuntime 'org.seleniumhq.selenium:selenium-firefox-driver'
    testRuntime 'org.seleniumhq.selenium:selenium-safari-driver'

    implementation 'org.slf4j:jcl-over-slf4j'  // Apache/Jakarta Commons Logging -> slf4j
    implementation 'org.slf4j:jul-to-slf4j'  // java.util.logging -> slf4j
    implementation 'org.slf4j:log4j-over-slf4j'  // log4j1 -> slf4j; cf. log4j-to-slf4j
    implementation 'org.slf4j:slf4j-api'  // slf4j itself

    /*
     * Enable `import spock.lang.*`.
     *
     * N.B., these libraries needlessly duplicate Grails' imports.
     */
    testCompile('org.spockframework:spock-core:1.3-groovy-2.4') {
        exclude group: 'org.codehaus.groovy', module: 'groovy-all'
    }
    testCompile('org.spockframework:spock-spring:1.3-groovy-2.4') {
        exclude group: 'org.codehaus.groovy', module: 'groovy-all'
    }

    // enable `import org.springframework.orm.hibernate5.*`
    implementation 'org.springframework:spring-orm'

    /*
     * The rendering plugin requires this module at runtime (OBS-372):
     * 1. grails.plugins.rendering.document.RenderEnvironment.init(), calls
     * 2. grails.util.GrailsWebMockUtil.bindMockWebRequest(), creates
     * 3. org.springframework.mock.web.MockHttpServletRequest
     */
    runtime 'org.springframework:spring-test'

    // may enable '/health' and '/info' endpoints
    compile 'org.springframework.boot:spring-boot-starter-actuator'

    // set up Spring log framework (slf4j under the hood)
    implementation 'org.springframework.boot:spring-boot-starter-logging'

    implementation "org.xhtmlrenderer:flying-saucer-core:${flyingSaucerVersion}"
    implementation "org.xhtmlrenderer:flying-saucer-pdf-openpdf:${flyingSaucerVersion}"

    implementation 'com.github.albfernandez:juniversalchardet:2.4.0'

    // security patch
    compile 'org.yaml:snakeyaml:1.33'
    console 'org.yaml:snakeyaml:1.33'

    // For integration tests
    testCompile 'org.apache.commons:commons-compress:1.21'  // Needed to avoid a dependency conflict
    testCompile "org.testcontainers:mysql:1.17.3"
    testCompile "org.testcontainers:mariadb:1.17.3"
    testCompile "org.testcontainers:spock:1.17.3"
    testCompile 'org.springframework:spring-test'
    testCompile 'io.rest-assured:rest-assured:3.2.0'
    testCompile "org.grails.plugins:build-test-data:3.3.1"
}

/*
 * Create a grails.build.info file after every successful build, whose
 * contents can be retrieved via <g:meta name='property.name' /> or
 * grailsApplication.metadata.getProperty('property.name').
 *
 * https://grails.org/blog/2017-04-02.html
 */
buildProperties.doLast {
    File grailsBuildInfoFile = it.outputs.files.files.find {
        it.name == 'grails.build.info'
    }

    Map<String, String> env = System.getenv()
    Properties properties = new Properties()

    // load any information created by the build itself
    if (grailsBuildInfoFile?.canRead()) {
        grailsBuildInfoFile?.withInputStream {
            properties.load(it)
        }
    }

    properties.with {
        setProperty('build.host', InetAddress.localHost.hostName)
        setProperty('build.java.version', System.getProperty('java.version'))
        setProperty('build.tag', env.BUILD_TAG ?: 'N/A')
        setProperty('build.time', LocalDateTime.now().format(DateTimeFormatter.ISO_DATE_TIME))
        setProperty('build.username', System.properties['user.name'])

        if (env.bamboo_planRepository_branch) {
            setProperty('build.git.branch.default', env.bamboo_planRepository_branch)
        }
        if (env.bamboo_customRevision) {
            setProperty('build.git.revision.custom', env.bamboo_customRevision)
        }
        if (env.bamboo_repository_revision_number) {
            setProperty('build.git.sha', env.bamboo_repository_revision_number)
        }
    }

    grailsBuildInfoFile.withOutputStream {
        properties.store(it, null)
    }
}

/*
 * This lightweight task logs release info for node, npm and friends.
 */
task nodeVersionInfo(type: NpmTask) {
    dependsOn npmSetup
    args = ['version']
}

npm_run_bundle.dependsOn nodeVersionInfo

task prepareDocker(type: Copy, dependsOn: assemble) {
    description = 'Copy files from ./docker and openboxes.war to build directory'
    group = 'Docker'

    from 'build/libs/openboxes.war'
    from 'docker/Dockerfile'

    into mkdir("${buildDir}/docker")
}

task writePom {
    description = 'Derive a Maven-compatible pom.xml file for downstream analysis'
    group = 'Reporting'
    doLast {
        pom {}.writeTo('pom.xml')
    }
}

tasks.withType(Test) {
    systemProperty 'geb.build.reportsDir', reporting.file('geb/integrationTest')
    systemProperty 'geb.env', System.getProperty('geb.env')
    systemProperty 'webdriver.chrome.driver', System.getProperty('webdriver.chrome.driver')
    systemProperty 'webdriver.firefox.driver', System.getProperty('webdriver.firefox.driver')
    testLogging {
        events 'failed', 'passed', 'skipped'
        exceptionFormat 'full'
    }
}

/**
 * Used when running integration tests. Can be defined at the commandline by our build and
 * test pipelines (which use secrets, not plaintext passwords).
 */
test {
    systemProperty "username", System.getProperty("username")
    systemProperty "password", System.getProperty("password")
}

integrationTest {
    testLogging {
        events "passed", "skipped", "failed"
        showStackTraces = true
        showStandardStreams = true
    }
}