quoll-cli 0.2.0__py3-none-any.whl

quoll/languages/java/ci.py

@@ -0,0 +1,163 @@
+from __future__ import annotations
+
+from typing import TYPE_CHECKING, Any, Dict, List, Optional, Sequence
+
+from quoll.ci.steps import ROOT, SUMMARY_FILE, Cache, Item, Step, step
+from quoll.ci.tools import install_osv_scanner
+from quoll.languages.base import THRESHOLD_REGEX, CISteps, TestReports
+from quoll.platforms.github.actions import ACTIONS
+
+if TYPE_CHECKING:
+    from quoll.ci.config import CIConfig
+    from quoll.languages.base import Detection
+
+_BUILD_TOOL = {
+    "maven": "mvn -B -ntp",
+    "maven-wrapper": "./mvnw -B -ntp",
+    "gradle": "gradle",
+    "gradle-wrapper": "./gradlew",
+}
+
+# tool: (step name, maven goal, gradle tasks). Static analysis runs on Maven without any pom.xml change (the full
+# plugin coordinates); on Gradle, its plugin must be applied in the build.
+_LINT = {
+    "spotless": ("Spotless", "spotless:check", "spotlessCheck"),
+    "checkstyle": ("Checkstyle", "checkstyle:check", "checkstyleMain checkstyleTest"),
+    "ktlint": ("ktlint", "ktlint:check", "ktlintCheck"),
+    "detekt": ("detekt", "detekt:check", "detekt"),
+    # SpotBugs analyses the compiled classes.
+    "spotbugs": ("SpotBugs", "compile com.github.spotbugs:spotbugs-maven-plugin:4.10.5.0:check", "spotbugsMain"),
+    "pmd": ("PMD", "org.apache.maven.plugins:maven-pmd-plugin:3.28.0:check", "pmdMain"),
+}
+
+# JaCoCo, without any build file change: Maven runs the plugin's goals around `verify`, Gradle applies the plugin
+# from an init script.
+_JACOCO = "org.jacoco:jacoco-maven-plugin:0.8.16"
+_JACOCO_INIT = "/tmp/quoll-jacoco.gradle"
+_JACOCO_GRADLE = f"""cat > {_JACOCO_INIT} <<'EOF'
+allprojects {{
+    pluginManager.withPlugin("java") {{
+        apply plugin: "jacoco"
+        jacocoTestReport {{ reports {{ xml.required = true }} }}
+        test {{ finalizedBy jacocoTestReport }}
+    }}
+}}
+EOF"""
+# The line coverage of every module: the last LINE counter of a JaCoCo report is its total.
+_COVERAGE_CHECK = """reports=$(find . -path '*/target/site/jacoco/jacoco.xml' \\
+  -o -path '*/build/reports/jacoco/test/jacocoTestReport.xml')
+if [ -z "$reports" ]; then
+  echo "::error::No JaCoCo report: does the build override the test JVM arguments (argLine)?"
+  exit 1
+fi
+total=$(for f in $reports; do grep -o '<counter type="LINE" missed="[0-9]*" covered="[0-9]*"/>' "$f" | tail -1; done \\
+  | sed 's/[^0-9 ]//g' | awk '{{ m += $1; c += $2 }} END {{ printf "%.1f", (m + c) ? c * 100 / (m + c) : 100 }}')
+echo "### Coverage: ${{total}}%" >> {summary}
+awk -v total="$total" -v min={threshold} 'BEGIN {{
+  if (total + 0 < min) {{ printf "::error::Coverage %.1f%% is below the %d%% threshold\\n", total, min; exit 1 }}
+  printf "Coverage %.1f%% (threshold %d%%)\\n", total, min
+}}'"""
+
+def build_tool(package_manager: str) -> str:
+    return _BUILD_TOOL[package_manager]
+
+
+class JavaCI(CISteps):
+    version_key = "java-version"
+    codeql_language = "java-kotlin"
+    # osv-scanner reads the build files directly.
+    audit_needs_setup = False
+
+    def setup(self, cfg: CIConfig, version: Optional[str]) -> List[Item]:
+        maven = _is_maven(cfg)
+        with_: Dict[str, Any] = {"distribution": "temurin"}
+        if version:
+            with_["java-version"] = version
+        else:
+            with_["java-version-file"] = cfg.path(cfg.version_file)
+        if maven and cfg.cache:
+            with_["cache"] = "maven"
+        steps = [step("Set up Java", uses=ACTIONS["setup-java"], with_=with_)]
+        if not maven:
+            # setup-gradle caches Gradle's dependencies and build outputs.
+            with_gradle = None if cfg.cache else {"cache-disabled": True}
+            steps.append(step("Set up Gradle", uses=ACTIONS["setup-gradle"], with_=with_gradle))
+        return steps
+
+    def image(self, cfg: CIConfig, version: str) -> str:
+        if cfg.package_manager == "maven":
+            return f"maven:3-eclipse-temurin-{version}"
+        if cfg.package_manager == "gradle":
+            return f"gradle:jdk{version}"
+        return f"eclipse-temurin:{version}-jdk"
+
+    def cache(self, cfg: CIConfig) -> Optional[Cache]:
+        if not cfg.cache:
+            return None
+        if _is_maven(cfg):
+            env = {"MAVEN_OPTS": f"-Dmaven.repo.local={ROOT}/.m2/repository"}
+            return Cache("maven", (".m2/repository",), key_files=("pom.xml",), env=env)
+        return Cache("gradle", (".gradle/caches", ".gradle/wrapper"), env={"GRADLE_USER_HOME": f"{ROOT}/.gradle"})
+
+    def install(self, cfg: CIConfig, packages: Sequence[str] = ()) -> List[Step]:
+        # Maven and Gradle resolve dependencies as part of each command.
+        return [step("Resolve dependencies", run=cfg.install)] if cfg.install else []
+
+    def lint(self, cfg: CIConfig, tools: List[str]) -> List[Item]:
+        steps = self.install(cfg)
+        for tool in tools:
+            name, goal, tasks = _LINT[tool]
+            steps.append(step(name, run=f"{build_tool(cfg.package_manager)} {goal if _is_maven(cfg) else tasks}"))
+        return steps
+
+    def test(self, cfg: CIConfig) -> List[Item]:
+        t = cfg.test
+        tool = build_tool(cfg.package_manager)
+        if not t.coverage:
+            cmd = f"{tool} {'verify' if _is_maven(cfg) else 'check'}"
+            return [*self.install(cfg), step("Tests", run=cmd, secrets=t.env_secrets)]
+        steps: List[Item] = list(self.install(cfg))
+        if _is_maven(cfg):
+            cmd = f"{tool} {_JACOCO}:prepare-agent verify {_JACOCO}:report"
+        else:
+            steps.append(step("JaCoCo for Gradle", run=_JACOCO_GRADLE))
+            cmd = f"{tool} check --init-script {_JACOCO_INIT}"
+        return [
+            *steps,
+            step("Tests with coverage", run=cmd, secrets=t.env_secrets),
+            step(
+                "Coverage threshold",
+                run=_COVERAGE_CHECK.format(threshold=t.coverage_threshold, summary=SUMMARY_FILE),
+            ),
+        ]
+
+    def coverage_file(self, cfg: CIConfig) -> str:
+        if _is_maven(cfg):
+            return "target/site/jacoco/jacoco.xml"
+        return "build/reports/jacoco/test/jacocoTestReport.xml"
+
+    def reports(self, cfg: CIConfig) -> TestReports:
+        # Surefire and Gradle write JUnit results by themselves.
+        regex = THRESHOLD_REGEX if cfg.test.coverage else ""
+        if _is_maven(cfg):
+            return TestReports(junit="target/surefire-reports/TEST-*.xml", coverage_regex=regex)
+        return TestReports(junit="build/test-results/test/TEST-*.xml", coverage_regex=regex)
+
+    def audit(self, cfg: CIConfig) -> List[Item]:
+        return [
+            install_osv_scanner(),
+            step("Dependency vulnerability scan", run="osv-scanner scan source --recursive ."),
+        ]
+
+    def build(self, cfg: CIConfig) -> List[Item]:
+        return [*self.install(cfg), step("Build", run=cfg.build.command)]
+
+    def build_artifacts(self, det: Detection) -> List[str]:
+        return ["target/*.jar"] if det.package_manager.startswith("maven") else ["build/libs/*.jar"]
+
+    def dependabot_ecosystem(self, cfg: CIConfig) -> str:
+        return "maven" if _is_maven(cfg) else "gradle"
+
+
+def _is_maven(cfg: CIConfig) -> bool:
+    return cfg.package_manager.startswith("maven")

quoll/languages/java/detect.py

@@ -0,0 +1,77 @@
+from __future__ import annotations
+
+import re
+from typing import List
+
+from quoll.languages.base import Detection
+from quoll.languages.java.ci import build_tool
+from quoll.project import Project
+from quoll.services import detect_services
+
+JAVA_DEFAULT = "21"
+JAVA_LTS = ("17", "21", "25")
+
+_VERSION_PATTERNS = (
+    r"<java\.version>\s*(?:1\.)?(\d+)",
+    r"<maven\.compiler\.release>\s*(\d+)",
+    r"<maven\.compiler\.source>\s*(?:1\.)?(\d+)",
+    r"<release>\s*(\d+)\s*</release>",
+    r"JavaLanguageVersion\.of\(\s*(\d+)\s*\)",
+    r"JavaVersion\.VERSION_(?:1_)?(\d+)",
+    r"jvmToolchain\(\s*(\d+)\s*\)",
+    r"sourceCompatibility\s*=\s*['\"]?(?:1\.)?(\d+)",
+)
+
+# Artifacts revealing a backing service.
+_SERVICE_ARTIFACTS = {
+    "postgres": ("org.postgresql", "postgresql:postgresql"),
+    "mysql": ("mysql-connector", "com.mysql"),
+    "redis": ("spring-boot-starter-data-redis", "jedis", "lettuce-core", "redisson"),
+    "mongodb": ("mongodb-driver", "spring-boot-starter-data-mongodb"),
+}
+# Enabled when their plugin name appears in a build file.
+_LINT_TOOLS = ("spotless", "checkstyle", "ktlint", "detekt", "spotbugs", "pmd")
+
+
+def detect(project: Project) -> Detection:
+    det = Detection(install="", lockfile="")
+    if project.exists("pom.xml"):
+        det.package_manager = "maven-wrapper" if project.exists("mvnw") else "maven"
+    else:
+        det.package_manager = "gradle-wrapper" if project.exists("gradlew") else "gradle"
+    if det.package_manager in ("maven", "gradle"):
+        wrapper = "mvnw" if det.package_manager == "maven" else "gradlew"
+        det.warnings.append(f"No ./{wrapper} found — the CI uses the runner's {det.package_manager}.")
+
+    build_files = build_text(project)
+    if project.exists(".java-version"):
+        det.version_file = ".java-version"
+        det.version = project.read_text(".java-version").strip().split(".")[0] or JAVA_DEFAULT
+    else:
+        det.version = next(
+            (m.group(1) for p in _VERSION_PATTERNS for m in [re.search(p, build_files)] if m), JAVA_DEFAULT
+        )
+    low = int(det.version) if det.version.isdigit() else 0
+    det.matrix_versions = [v for v in JAVA_LTS if int(v) >= low] or [det.version]
+
+    det.lint_tools = [tool for tool in _LINT_TOOLS if tool in build_files]
+    if project.glob_any("src/test", "*/src/test"):
+        det.test_runner = "junit"
+    else:
+        det.warnings.append("No src/test directory found — the test job is disabled.")
+
+    found = [a for artifacts in _SERVICE_ARTIFACTS.values() for a in artifacts if a in build_files]
+    det.services = detect_services(found, _SERVICE_ARTIFACTS)
+
+    tool = build_tool(det.package_manager)
+    det.build_command = f"{tool} package -DskipTests" if det.package_manager.startswith("maven") else f"{tool} assemble"
+    return det
+
+
+def build_text(project: Project) -> str:
+    """Contents of the root and module build files."""
+    names: List[str] = ["pom.xml", "build.gradle", "build.gradle.kts", "settings.gradle", "settings.gradle.kts"]
+    files = [project.read_text(n) for n in names]
+    files += [p.read_text() for p in project.glob("*/pom.xml", "*/build.gradle", "*/build.gradle.kts")]
+    files.append(project.read_text("gradle/libs.versions.toml"))
+    return "\n".join(files)

quoll/languages/java/docker.py

@@ -0,0 +1,45 @@
+from __future__ import annotations
+
+from typing import TYPE_CHECKING, Any, Dict, List
+
+from quoll.languages.base import Detection, DockerDefaults, DockerImage
+from quoll.languages.java.ci import build_tool
+from quoll.project import Project
+
+if TYPE_CHECKING:
+    from quoll.docker.config import DockerConfig
+
+
+class JavaImage(DockerImage):
+    def defaults(self, project: Project, det: Detection) -> DockerDefaults:
+        return DockerDefaults(
+            port=8080,
+            command="java -jar /app/app.jar",
+            build_command=self.build_command(det.package_manager),
+            warnings=["The image runs the built jar: make sure it is executable (Main-Class in its manifest)."],
+        )
+
+    def build_command(self, package_manager: str) -> str:
+        tool = build_tool(package_manager)
+        return f"{tool} package -DskipTests" if package_manager.startswith("maven") else f"{tool} assemble"
+
+    def context(self, project: Project, cfg: DockerConfig) -> Dict[str, Any]:
+        pm, version = cfg.package_manager, cfg.version
+        maven = pm.startswith("maven")
+        # Wrappers fetch their own Maven/Gradle; otherwise build in the official Maven/Gradle image.
+        build_image = {
+            "maven-wrapper": f"eclipse-temurin:{version}-jdk",
+            "gradle-wrapper": f"eclipse-temurin:{version}-jdk",
+            "maven": f"maven:3-eclipse-temurin-{version}",
+            "gradle": f"gradle:jdk{version}",
+        }[pm]
+        return {
+            "build_image": build_image,
+            "cache": "/root/.m2" if maven else ("/home/gradle/.gradle" if pm == "gradle" else "/root/.gradle"),
+            "jar_dir": "target" if maven else "build/libs",
+            # Wrappers committed from Windows or unzipped lose their executable bit.
+            "wrapper": {"maven-wrapper": "mvnw", "gradle-wrapper": "gradlew"}.get(pm, ""),
+        }
+
+    def dockerignore(self, cfg: DockerConfig) -> List[str]:
+        return ["target", "build", ".gradle", "**/*.class", ".env", ".env.*", "!.env.example"]

quoll/languages/java/frameworks/__init__.py

@@ -0,0 +1 @@
+"""JVM frameworks."""

quoll/languages/java/frameworks/spring_boot/Dockerfile.j2

@@ -0,0 +1,18 @@
+{% extends "java/Dockerfile.j2" %}
+
+{% block runtime %}
+# Split the jar into layers (Spring Boot 3.3+): dependencies change less often than the code.
+FROM eclipse-temurin:{{ cfg.version }}-jre AS layers
+WORKDIR /layers
+COPY --from=build /out/app.jar app.jar
+RUN java -Djarmode=tools -jar app.jar extract --layers --launcher --destination extracted
+
+{{ super() }}
+{%- endblock %}
+
+{% block app_files %}
+COPY --from=layers /layers/extracted/dependencies/ ./
+COPY --from=layers /layers/extracted/spring-boot-loader/ ./
+COPY --from=layers /layers/extracted/snapshot-dependencies/ ./
+COPY --from=layers /layers/extracted/application/ ./
+{% endblock %}

quoll/languages/java/frameworks/spring_boot/__init__.py

@@ -0,0 +1,10 @@
+"""Spring Boot: Maven/Gradle already run its tests; the image ships the jar as cache-friendly layers."""
+
+from quoll.languages.base import Framework
+from quoll.languages.java.frameworks.spring_boot.detect import detect
+from quoll.languages.java.frameworks.spring_boot.docker import SpringBootImage
+from quoll.languages.java.frameworks.spring_boot.services import service_env
+
+framework = Framework(
+    name="spring-boot", language="java", detect=detect, docker=SpringBootImage(), service_env=service_env
+)

quoll/languages/java/frameworks/spring_boot/detect.py

@@ -0,0 +1,9 @@
+from __future__ import annotations
+
+from quoll.languages.base import Detection
+from quoll.languages.java.detect import build_text
+from quoll.project import Project
+
+
+def detect(project: Project, det: Detection) -> bool:
+    return "spring-boot" in build_text(project)

quoll/languages/java/frameworks/spring_boot/docker.py

@@ -0,0 +1,19 @@
+from __future__ import annotations
+
+from quoll.languages.base import Detection, DockerDefaults
+from quoll.languages.java.ci import build_tool
+from quoll.languages.java.docker import JavaImage
+from quoll.project import Project
+
+
+class SpringBootImage(JavaImage):
+    def defaults(self, project: Project, det: Detection) -> DockerDefaults:
+        return DockerDefaults(
+            port=8080,
+            command="java org.springframework.boot.loader.launch.JarLauncher",
+            build_command=self.build_command(det.package_manager),
+        )
+
+    def build_command(self, package_manager: str) -> str:
+        tool = build_tool(package_manager)
+        return f"{tool} package -DskipTests" if package_manager.startswith("maven") else f"{tool} bootJar"

quoll/languages/java/frameworks/spring_boot/services.py

@@ -0,0 +1,24 @@
+from __future__ import annotations
+
+from typing import Dict
+
+
+def service_env(service: str, host: str, database: str) -> Dict[str, str]:
+    """Spring Boot binds SPRING_* variables to its datasource, Redis and MongoDB properties."""
+    if service == "postgres":
+        return {
+            "SPRING_DATASOURCE_URL": f"jdbc:postgresql://{host}:5432/{database}",
+            "SPRING_DATASOURCE_USERNAME": "app",
+            "SPRING_DATASOURCE_PASSWORD": "app",
+        }
+    if service == "mysql":
+        return {
+            "SPRING_DATASOURCE_URL": f"jdbc:mysql://{host}:3306/{database}",
+            "SPRING_DATASOURCE_USERNAME": "root",
+            "SPRING_DATASOURCE_PASSWORD": "root",
+        }
+    if service == "redis":
+        return {"SPRING_DATA_REDIS_HOST": host}
+    if service == "mongodb":
+        return {"SPRING_DATA_MONGODB_URI": f"mongodb://{host}:27017/{database}"}
+    return {}

quoll/languages/node/Dockerfile.j2

@@ -0,0 +1,98 @@
+{% block deps %}
+FROM {{ build_image }} AS deps
+WORKDIR /app
+{% if setup %}
+RUN {{ setup }}
+{% endif %}
+# Dependencies first: code changes don't reinstall them.
+RUN --mount=type=cache,target={{ cache }} \
+{% for f in install_files + install_dirs %}
+    --mount=type=bind,source={{ f }},target={{ f }} \
+{% endfor %}
+    {{ install }}
+{% endblock %}
+
+{% block build %}
+FROM deps AS build
+COPY . .
+{% for key, value in build_env.items() %}
+ENV {{ key }}={{ value }}
+{% endfor %}
+{% if cfg.build_command %}
+RUN {{ cfg.build_command }}
+{% endif %}
+{% if not cfg.static and not cfg.output_dir and prune %}
+# Ship production dependencies only.
+RUN {{ prune }}
+{% endif %}
+{% endblock %}
+
+{% block runtime %}
+{% if cfg.static %}
+FROM nginxinc/nginx-unprivileged:1-alpine
+# Security fixes Alpine released since the base image was built.
+USER root
+RUN apk upgrade --no-cache
+USER 101
+{% if cfg.proxy %}
+# Filled in at startup with the API URLs from the environment.
+COPY <<"EOF" /etc/nginx/templates/default.conf.template
+{% else %}
+COPY <<"EOF" /etc/nginx/conf.d/default.conf
+{% endif %}
+server {
+    listen {{ cfg.port }};
+    root /usr/share/nginx/html;
+{% for path, variable in cfg.proxy.items() %}
+    location {{ path }} {
+        proxy_pass {{ "${" ~ variable ~ "}" }};
+        proxy_set_header Host $host;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+    }
+{% endfor %}
+    location / {
+        try_files $uri $uri/ {{ "/index.html" if spa else "$uri.html =404" }};
+    }
+{% if not spa %}
+    error_page 404 /404.html;
+{% endif %}
+}
+EOF
+{% if cfg.proxy %}
+# Without the API URLs, stop at startup with what to set.
+COPY --chmod=755 <<"EOF" /docker-entrypoint.d/05-quoll-proxy.sh
+#!/bin/sh
+{% for path, variable in cfg.proxy.items() %}
+: "{{ "${" ~ variable }}:?is the URL {{ path }} is forwarded to, e.g. http://api:3000 (no path)}"
+{% endfor %}
+EOF
+{% endif %}
+COPY --from=build /app/{{ cfg.output_dir }} /usr/share/nginx/html
+EXPOSE {{ cfg.port }}
+{% else %}
+FROM {{ runtime_image }}
+{{ os_updates }}
+{% if user == "node" and "npm" not in cfg.command and "npx" not in cfg.command %}
+# npm and corepack built the app; the container only runs it (and they carry their own vulnerabilities).
+RUN rm -rf /usr/local/lib/node_modules/npm /usr/local/lib/node_modules/corepack \
+    /usr/local/bin/npm /usr/local/bin/npx /usr/local/bin/corepack
+{% endif %}
+ENV {% for key, value in env.items() %}{{ key }}={{ value }}{{ " \\\n    " if not loop.last }}{% endfor %}
+
+WORKDIR /app
+{% block app_files %}
+{% if cfg.output_dir %}
+# The build output is self-contained.
+COPY --from=build --chown={{ user }}:{{ user }} /app/{{ cfg.output_dir }} ./{{ cfg.output_dir }}
+{% else %}
+ENV PATH="/app/node_modules/.bin:$PATH"
+COPY --from=build --chown={{ user }}:{{ user }} /app ./
+{% endif %}
+{% endblock %}
+# Numeric: Kubernetes can then check it isn't root (runAsNonRoot).
+USER {{ uid }}
+EXPOSE {{ cfg.port }}
+CMD {{ cfg.command | exec_form }}
+{% endif %}
+{% endblock %}

quoll/languages/node/__init__.py

@@ -0,0 +1,29 @@
+"""Node.js (and front-end) projects: npm, pnpm, yarn and bun."""
+
+from quoll.languages.base import Language
+from quoll.languages.node.ci import NodeCI
+from quoll.languages.node.detect import detect
+from quoll.languages.node.docker import NodeImage
+from quoll.languages.node.frameworks import angular, astro, nestjs, nextjs, nuxt, sveltekit
+from quoll.languages.node.starter import starter as express
+
+language = Language(
+    name="node",
+    markers=("package.json",),
+    package_managers=("npm", "pnpm", "yarn", "yarn-classic", "bun"),
+    lint_tools=("eslint", "prettier", "biome", "tsc"),
+    test_runners=("jest", "vitest", "bun"),
+    detect=detect,
+    ci=NodeCI(),
+    frameworks=(
+        nextjs.framework,
+        nuxt.framework,
+        sveltekit.framework,
+        astro.framework,
+        angular.framework,
+        nestjs.framework,
+    ),
+    scripts=True,
+    docker=NodeImage(),
+    starters=(express,),
+)