SONARJAVA-4750 Use Java 21 in the CI to build sonar-java (#4645)

.cirrus.yml

@@ -1,4 +1,7 @@
 env:
+  CIRRUS_VAULT_URL: https://vault.sonar.build:8200
+  CIRRUS_VAULT_AUTH_PATH: jwt-cirrusci
+  CIRRUS_VAULT_ROLE: cirrusci-${CIRRUS_REPO_OWNER}-${CIRRUS_REPO_NAME}
   ARTIFACTORY_URL: VAULT[development/kv/data/repox data.url]
   ARTIFACTORY_PRIVATE_USERNAME: vault-${CIRRUS_REPO_OWNER}-${CIRRUS_REPO_NAME}-private-reader
   ARTIFACTORY_PRIVATE_PASSWORD: VAULT[development/artifactory/token/${CIRRUS_REPO_OWNER}-${CIRRUS_REPO_NAME}-private-reader access_token]
@@ -22,7 +25,6 @@ env:
   CIRRUS_CLONE_DEPTH: 50
 
 container_definition: &CONTAINER_DEFINITION
-  image: ${CIRRUS_AWS_ACCOUNT}.dkr.ecr.eu-central-1.amazonaws.com/base:j11-latest
   cluster_name: ${CIRRUS_CLUSTER_NAME}
   region: eu-central-1
   namespace: default
@@ -34,21 +36,19 @@ container_definition: &CONTAINER_DEFINITION
             - m4.4xlarge # 2.4 GHz Intel Xeon E5-2676 v3** Processor, 16 vCPU, 64 GiB Memory
 
 win_vm_definition: &WINDOWS_VM_DEFINITION
-  ec2_instance:
-    experimental: true # see https://github.com/cirruslabs/cirrus-ci-docs/issues/1051
-    image: base-windows-jdk17-v*
-    platform: windows
-    region: eu-central-1
-    type: c5.4xlarge # 3.6 GHz (3.9GHz single core) Intel Xeon Scalable Processor, 16 vCPU, 32 GiB Memory
-    subnet_id: ${CIRRUS_AWS_SUBNET}
+  experimental: true # see https://github.com/cirruslabs/cirrus-ci-docs/issues/1051
+  platform: windows
+  region: eu-central-1
+  type: c5.4xlarge # 3.6 GHz (3.9GHz single core) Intel Xeon Scalable Processor, 16 vCPU, 32 GiB Memory
+  subnet_id: ${CIRRUS_AWS_SUBNET}
 
 only_sonarsource_qa: &ONLY_SONARSOURCE_QA
   only_if: $CIRRUS_USER_COLLABORATOR == 'true' && $CIRRUS_TAG == "" && ($CIRRUS_PR != "" || $CIRRUS_BRANCH == "master" || $CIRRUS_BRANCH =~ "branch-.*" || $CIRRUS_BRANCH =~ "dogfood-on-.*")
 
 common_build_definition: &COMMON_BUILD_DEFINITION
   eks_container:
     <<: *CONTAINER_DEFINITION
-    image: ${CIRRUS_AWS_ACCOUNT}.dkr.ecr.eu-central-1.amazonaws.com/base:j19-latest
+    image: ${CIRRUS_AWS_ACCOUNT}.dkr.ecr.eu-central-1.amazonaws.com/base:j21-latest
     cpu: 4
     memory: 4G
   env:
@@ -82,6 +82,7 @@ ws_scan_task:
   <<: *ONLY_SONARSOURCE_QA
   eks_container:
     <<: *CONTAINER_DEFINITION
+    image: ${CIRRUS_AWS_ACCOUNT}.dkr.ecr.eu-central-1.amazonaws.com/base:j17-latest
     cpu: 4
     memory: 4G
   # run only on master and long-term branches
@@ -101,7 +102,9 @@ ws_scan_task:
       path: "whitesource/**/*"
 
 qa_os_win_task:
-  <<: *WINDOWS_VM_DEFINITION
+  ec2_instance:
+    image: base-windows-jdk21-v*
+    <<: *WINDOWS_VM_DEFINITION
   maven_cache:
     folder: ${CIRRUS_WORKING_DIR}/.m2/repository
   build_script:
@@ -140,7 +143,7 @@ sanity_task:
   <<: *ONLY_SONARSOURCE_QA
   eks_container:
     <<: *CONTAINER_DEFINITION
-    image: ${CIRRUS_AWS_ACCOUNT}.dkr.ecr.eu-central-1.amazonaws.com/base:j17-latest
+    image: ${CIRRUS_AWS_ACCOUNT}.dkr.ecr.eu-central-1.amazonaws.com/base:j21-latest
     cpu: 4
     memory: 2G
   maven_cache:
@@ -184,7 +187,9 @@ ruling_win_task:
   depends_on:
     - build
   <<: *ONLY_SONARSOURCE_QA
-  <<: *WINDOWS_VM_DEFINITION
+  ec2_instance:
+    image: base-windows-jdk17-v*
+    <<: *WINDOWS_VM_DEFINITION
   maven_cache:
     folder: ${CIRRUS_WORKING_DIR}/.m2/repository
   env:
@@ -207,15 +212,23 @@ autoscan_task:
   <<: *ONLY_SONARSOURCE_QA
   eks_container:
     <<: *CONTAINER_DEFINITION
-    image: ${CIRRUS_AWS_ACCOUNT}.dkr.ecr.eu-central-1.amazonaws.com/base:j17-latest
+    # For now, this autoscan_task need to execute two mvn commands:
+    # * The build of java-checks-test-sources module which requires Java 21.
+    # * The tests using Orchestrator and SonarQube that, for now, fail to work using Java 21
+    # This is why we have a local Dockerfile that provide the 2 versions of Java, 17 and 21.
+    dockerfile: .cirrus/Dockerfile.jdk17And21
+    builder_role: cirrus-builder
+    builder_image: docker-builder-v*
+    builder_instance_type: t3.small
+    builder_subnet_id: ${CIRRUS_AWS_SUBNET}
     cpu: 14
     memory: 6G
   maven_cache:
     folder: ${CIRRUS_WORKING_DIR}/.m2/repository
   autoscan_script:
     - source cirrus-env QA
     - source set_maven_build_version $BUILD_NUMBER
-    - mvn clean compile --projects java-checks-test-sources --also-make-dependents
+    - JAVA_HOME="${JAVA_21_HOME}" mvn clean compile --projects java-checks-test-sources --also-make-dependents
     - cd its/autoscan
     - mvn clean package --batch-mode --errors --show-version --activate-profiles it-autoscan -Dsonar.runtimeVersion=LATEST_RELEASE[9.9] -Dmaven.test.redirectTestOutputToFile=false -Dparallel=methods -DuseUnlimitedThreads=true
   cleanup_before_cache_script: cleanup_maven_repository
@@ -237,6 +250,7 @@ promote_task:
   <<: *ONLY_SONARSOURCE_QA
   eks_container:
     <<: *CONTAINER_DEFINITION
+    image: ${CIRRUS_AWS_ACCOUNT}.dkr.ecr.eu-central-1.amazonaws.com/base:j17-latest
     cpu: 2
     memory: 1G
   env:

.cirrus/Dockerfile.jdk17And21

@@ -0,0 +1,58 @@
+ARG CIRRUS_AWS_ACCOUNT=275878209202
+FROM ${CIRRUS_AWS_ACCOUNT}.dkr.ecr.eu-central-1.amazonaws.com/base:j17-latest
+
+LABEL maintainer="JVM Squad at SonarSource"
+
+USER root
+
+ENV DEBIAN_FRONTEND=noninteractive
+
+# The current image is `FROM public.ecr.aws/docker/library/eclipse-temurin:17-jammy`
+# Use a similar method to install Java 21 copied from https://github.com/adoptium/containers/blob/main/21/jdk/ubuntu/jammy/Dockerfile
+
+ENV JAVA_21_HOME /opt/java/openjdk21
+ENV JAVA_21_VERSION jdk-21.0.2+13
+
+RUN set -eux; \
+    ARCH="$(dpkg --print-architecture)"; \
+    case "${ARCH}" in \
+       aarch64|arm64) \
+         ESUM='3ce6a2b357e2ef45fd6b53d6587aa05bfec7771e7fb982f2c964f6b771b7526a'; \
+         BINARY_URL='https://github.com/adoptium/temurin21-binaries/releases/download/jdk-21.0.2%2B13/OpenJDK21U-jdk_aarch64_linux_hotspot_21.0.2_13.tar.gz'; \
+         ;; \
+       amd64|i386:x86-64) \
+         ESUM='454bebb2c9fe48d981341461ffb6bf1017c7b7c6e15c6b0c29b959194ba3aaa5'; \
+         BINARY_URL='https://github.com/adoptium/temurin21-binaries/releases/download/jdk-21.0.2%2B13/OpenJDK21U-jdk_x64_linux_hotspot_21.0.2_13.tar.gz'; \
+         ;; \
+       ppc64el|powerpc:common64) \
+         ESUM='d08de863499d8851811c893e8915828f2cd8eb67ed9e29432a6b4e222d80a12f'; \
+         BINARY_URL='https://github.com/adoptium/temurin21-binaries/releases/download/jdk-21.0.2%2B13/OpenJDK21U-jdk_ppc64le_linux_hotspot_21.0.2_13.tar.gz'; \
+         ;; \
+       s390x|s390:64-bit) \
+         ESUM='0d5676c50821e0d0b951bf3ffd717e7a13be2a89d8848a5c13b4aedc6f982c78'; \
+         BINARY_URL='https://github.com/adoptium/temurin21-binaries/releases/download/jdk-21.0.2%2B13/OpenJDK21U-jdk_s390x_linux_hotspot_21.0.2_13.tar.gz'; \
+         ;; \
+       *) \
+         echo "Unsupported arch: ${ARCH}"; \
+         exit 1; \
+         ;; \
+    esac; \
+    wget --progress=dot:giga -O /tmp/openjdk.tar.gz ${BINARY_URL}; \
+    echo "${ESUM} */tmp/openjdk.tar.gz" | sha256sum -c -; \
+    mkdir -p "$JAVA_21_HOME"; \
+    tar --extract \
+        --file /tmp/openjdk.tar.gz \
+        --directory "$JAVA_21_HOME" \
+        --strip-components 1 \
+        --no-same-owner \
+    ; \
+    rm -f /tmp/openjdk.tar.gz ${JAVA_21_HOME}/lib/src.zip; \
+    # https://github.com/docker-library/openjdk/issues/331#issuecomment-498834472
+    find "$JAVA_21_HOME/lib" -name '*.so' -exec dirname '{}' ';' | sort -u > /etc/ld.so.conf.d/docker-openjdk.conf; \
+    ldconfig; \
+    # https://github.com/docker-library/openjdk/issues/212#issuecomment-420979840
+    # https://openjdk.java.net/jeps/341
+    java -Xshare:dump;
+
+USER sonarsource
+WORKDIR /home/sonarsource

README.md

@@ -55,7 +55,9 @@ To run tests locally follow these instructions.
 
 ### Java versions
 
-You need `Java 17` to build the project and run the Integration Tests (ITs).
+You need `Java 21` to build the project and `Java 17` run the Integration Tests (ITs).
+* `Java 17` can be used to build and test all modules except under `java-checks-test-sources` that requires `Java 21`.
+* `Java 21` can be used to build and test all modules except under `its` that requires `Java 17` because of SQ imcompatibility.
 
 ### Build the Project and Run Unit Tests
 

its/autoscan/src/test/java/org/sonar/java/it/AutoScanTest.java

@@ -122,9 +122,9 @@ public void javaCheckTestSources() throws Exception {
       .setProjectName(PROJECT_NAME)
       .setProjectVersion("0.1.0-SNAPSHOT")
       .setSourceEncoding("UTF-8")
-      .setSourceDirs("aws/src/main/java/,default/src/main/java/")
+      .setSourceDirs("aws/src/main/java/,default/src/main/java/,java-17/src/main/java/")
       .setTestDirs("default/src/test/java/")
-      .setProperty("sonar.java.source", "17")
+      .setProperty("sonar.java.source", "21")
       // common properties
       .setProperty("sonar.cpd.exclusions", "**/*")
       .setProperty("sonar.skipPackageDesign", "true")
@@ -198,7 +198,7 @@ public void javaCheckTestSources() throws Exception {
     softly.assertThat(newDiffs).containsExactlyInAnyOrderElementsOf(knownDiffs.values());
     softly.assertThat(newTotal).isEqualTo(knownTotal);
     softly.assertThat(rulesCausingFPs).hasSize(7);
-    softly.assertThat(rulesNotReporting).hasSize(7);
+    softly.assertThat(rulesNotReporting).hasSize(6);
 
     /**
      * 4. Check total number of differences (FPs + FNs)

its/autoscan/src/test/resources/autoscan/diffs/diff_S100.json

@@ -1,6 +1,6 @@
 {
   "ruleKey": "S100",
   "hasTruePositives": true,
-  "falseNegatives": 0,
+  "falseNegatives": 1,
   "falsePositives": 2
-}
+}

its/autoscan/src/test/resources/autoscan/diffs/diff_S3014.json

@@ -1,6 +1,6 @@
 {
   "ruleKey": "S3014",
   "hasTruePositives": true,
-  "falseNegatives": 0,
+  "falseNegatives": 1,
   "falsePositives": 0
-}
+}

its/autoscan/src/test/resources/autoscan/diffs/diff_S5738.json

@@ -1,6 +1,6 @@
 {
   "ruleKey": "S5738",
   "hasTruePositives": true,
-  "falseNegatives": 0,
+  "falseNegatives": 1,
   "falsePositives": 0
-}
+}

its/autoscan/src/test/resources/autoscan/diffs/diff_S6485.json

@@ -1,6 +1,6 @@
 {
   "ruleKey": "S6485",
-  "hasTruePositives": false,
+  "hasTruePositives": true,
   "falseNegatives": 0,
   "falsePositives": 0
-}
+}

java-checks-test-sources/README.md

@@ -2,7 +2,7 @@ SonarQube Java Analyzer - Rules Testing Sources
 =======
 
 This project is used as input for unit tests of our rules and our ITs.
-The project requirs JDK 17.
+The project requires JDK 21.
 
 To analyze it with a **local instance of SonarQube** up and running, use the following command from its root:
 ```

java-checks-test-sources/aws/pom.xml

@@ -51,7 +51,7 @@
     <dependency>
       <groupId>org.projectlombok</groupId>
       <artifactId>lombok</artifactId>
-      <version>1.18.20</version>
+      <version>1.18.30</version>
       <type>jar</type>
       <scope>provided</scope>
     </dependency>
@@ -117,9 +117,9 @@
         <groupId>org.apache.maven.plugins</groupId>
         <artifactId>maven-compiler-plugin</artifactId>
         <configuration>
-          <release>17</release>
-          <source>17</source>
-          <target>17</target>
+          <release>21</release>
+          <source>21</source>
+          <target>21</target>
         </configuration>
       </plugin>
       <plugin>

java-checks-test-sources/default/pom.xml

@@ -372,7 +372,7 @@
     <dependency>
       <groupId>org.projectlombok</groupId>
       <artifactId>lombok</artifactId>
-      <version>1.18.20</version>
+      <version>1.18.30</version>
       <type>jar</type>
       <scope>provided</scope>
     </dependency>
@@ -982,9 +982,9 @@
         <groupId>org.apache.maven.plugins</groupId>
         <artifactId>maven-compiler-plugin</artifactId>
         <configuration>
-          <release>17</release>
-          <source>17</source>
-          <target>17</target>
+          <release>21</release>
+          <source>21</source>
+          <target>21</target>
         </configuration>
       </plugin>
       <plugin>

java-checks-test-sources/default/sonar-project-no-binaries.properties

@@ -9,7 +9,7 @@ sonar.cpd.exclusions=**/*
 sonar.sources=src/main/java/
 sonar.tests=src/test/java/
 
-sonar.java.source=17
+sonar.java.source=21
 
 # Wrong on purpose - the project could be compiled (with maven) and provide binaries
 sonar.java.binaries=dummy-binaries/

java-checks-test-sources/default/sonar-project-with-binaries.properties

@@ -9,7 +9,7 @@ sonar.cpd.exclusions=**/*
 sonar.sources=src/main/java/
 sonar.tests=src/test/java/
 
-sonar.java.source=17
+sonar.java.source=21
 
 # The project should be compiled with maven at least once to have this working
 sonar.java.binaries=target/classes

java-checks-test-sources/default/src/main/java/checks/DisallowedThreadGroupCheck.java

@@ -16,7 +16,6 @@ void foo(
 
     tg.activeCount(); // Compliant - not following method invocation, only declarations of ThreadGroup
     tg.activeGroupCount(); // Compliant
-    tg.allowThreadSuspension(true); // Compliant
     getThreadGroup().checkAccess(); // Compliant
     tg.destroy(); // Compliant
     tg.enumerate(new Thread[0]); // Compliant