AAE-49637 Configure Mockito as a build agent to stop runtime self-attach

[mkrbr]

What kind of change does this PR introduce?

• Bugfix
• Feature
• Code style update (formatting, local variables)
• Refactoring (no functional changes, no api changes)
• Build related changes
• Documentation
• Other... Please describe:

Description

• Issue Link: https://hyland.atlassian.net/browse/AAE-49637

Does this PR introduce a breaking change? (check one with "x")

• Yes
• No

[github-actions]

🔒 Supply Chain Security

This PR modifies dependencies. To run a security analysis, comment:

/supply-chain-review

The analysis will check for vulnerabilities, typosquatting, maintainer takeovers, and other supply chain risks.

[Copilot]

Pull request overview

This PR aims to prevent Mockito/ByteBuddy “runtime self-attach” behavior during test execution by pre-attaching a Java agent via Maven test plugin configuration.

Changes:

• Adds -javaagent:"${org.mockito:mockito-core:jar}" to Surefire and Failsafe argLine.
• Introduces maven-dependency-plugin with the properties goal to expose a dependency-jar path as a Maven property for use in argLine.

Suppressed comments (2)

pom.xml:527

• maven-dependency-plugin execution isn’t bound to any lifecycle phase, so dependency:properties will not run during a normal build. That means the ${org.mockito:mockito-core:jar} property used by surefire/failsafe will typically remain unresolved and the JVM will fail to start with an invalid -javaagent path.

          <execution>
            <goals>
              <goal>properties</goal>
            </goals>
          </execution>

pom.xml:548

• The new -javaagent:"${org.mockito:mockito-core:jar}" assumes every module running unit tests resolves org.mockito:mockito-core. That’s not true for all modules (e.g. activiti-cloud-service-common/activiti-cloud-service-common-config has JUnit tests but no mockito-core dependency), so ${org.mockito:mockito-core:jar} will be undefined and surefire will pass an invalid agent path, breaking test execution. Consider ensuring the agent artifact is always resolved for all test modules (e.g., add a shared test dependency on mockito-core/mockito-agent in a common parent/BOM), or change the build to resolve/copy the agent jar explicitly and reference that path in argLine.

        <configuration>
          <argLine>@{argLine} -Xmx1024m -javaagent:"${org.mockito:mockito-core:jar}"</argLine>

[Copilot]

Pull request overview

Copilot reviewed 3 out of 3 changed files in this pull request and generated no new comments.

Suppressed comments (2)

pom.xml:523

• The newly added maven-dependency-plugin configuration is not managed in <pluginManagement> and has no explicit version, while this POM otherwise centralizes plugin versions via properties + <pluginManagement>. This can make builds less reproducible across different Maven installations; consider adding a managed plugin entry (with a pinned version) and keeping the <plugins> section versionless, consistent with the existing pattern.

      <plugin>
        <groupId>org.apache.maven.plugins</groupId>
        <artifactId>maven-dependency-plugin</artifactId>
        <executions>

pom.xml:528

• The new maven-dependency-plugin execution is not bound to an explicit lifecycle phase. That makes the availability of properties like org.mockito:mockito-core:jar depend on the goal’s defaultPhase (and therefore on the plugin version), which is fragile for ensuring -javaagent is always resolved before Surefire/Failsafe runs.

          <execution>
            <goals>
              <goal>properties</goal>
            </goals>
          </execution>

[Copilot]

Pull request overview

Copilot reviewed 3 out of 3 changed files in this pull request and generated no new comments.

Suppressed comments (3)

pom.xml:525

• maven-dependency-plugin:properties is configured to run during initialize for every module, which can add noticeable overhead and property noise because it resolves/exports properties for all project dependencies. Since this is only needed to obtain the mockito-core JAR path for the -javaagent arg, consider scoping the execution (e.g., restrict to org.mockito:mockito-core and the needed scopes) or moving the execution into only the modules that set mockito.agent.arg.

      <plugin>
        <groupId>org.apache.maven.plugins</groupId>
        <artifactId>maven-dependency-plugin</artifactId>
        <version>${maven-dependency-plugin.version}</version>
        <executions>

activiti-cloud-service-common/activiti-cloud-services-test-security/pom.xml:16

• The -javaagent argument wraps the resolved JAR path in quotes. Since Maven/Surefire argument parsing differs across platforms and versions, keeping the arg unquoted is typically safer unless you have a confirmed need to handle spaces in the local repository path.

  <properties>
    <enforcer.skip>true</enforcer.skip>
    <mockito.agent.arg>-javaagent:"${org.mockito:mockito-core:jar}"</mockito.agent.arg>
  </properties>

activiti-cloud-service-common/activiti-cloud-services-swagger/pom.xml:14

• The -javaagent argument wraps the resolved JAR path in quotes. Since Maven/Surefire argument parsing differs across platforms and versions, keeping the arg unquoted is typically safer unless you have a confirmed need to handle spaces in the local repository path.

  <artifactId>activiti-cloud-services-swagger</artifactId>
  <properties>
    <mockito.agent.arg>-javaagent:"${org.mockito:mockito-core:jar}"</mockito.agent.arg>
  </properties>

[Copilot]

Pull request overview

Copilot reviewed 3 out of 3 changed files in this pull request and generated no new comments.

Suppressed comments (1)

pom.xml:529

• Binding maven-dependency-plugin's properties goal to the initialize phase forces dependency resolution even for non-test lifecycles (e.g., mvn validate), which can slow builds and introduce extra network dependency. Since the resolved property is only used for Surefire/Failsafe argLine, consider running this execution later (e.g., process-test-classes) so it only happens when tests are part of the build lifecycle.

            <phase>initialize</phase>
            <goals>

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud