Merge pull request #22 from finos/main

align develop with main

Author: dschwartz-ftadvisory

.github/workflows/create-tagged-release.yml

@@ -36,7 +36,7 @@ jobs:
         TAG_NAME=${GITHUB_REF#refs/tags/}
         echo "Updating POM version to $TAG_NAME"
         mvn -B versions:set -DnewVersion=$TAG_NAME
-        mvn -B package --file pom.xml -DskipTests
+        mvn -B package
 
     - name: Revert POM changes
       run: git checkout -- pom.xml

.github/workflows/cve-scanning.yml

@@ -5,8 +5,13 @@ on:
     branches:
       - main
 
+# Cancel previous jobs
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+  
 jobs:
- depchecktest:
+  depchecktest:
     runs-on: ubuntu-latest
     name: depecheck_test
     steps:
@@ -18,23 +23,24 @@ jobs:
           java-version: '21'
           distribution: 'temurin'
       - name: Build with Maven
-        run: mvn install -DskipTests
+        run: mvn -B clean package -DskipTests
         working-directory: .
       - name: Depcheck
-        uses: dependency-check/Dependency-Check_Action@1.1.0
+        uses: dependency-check/Dependency-Check_Action@main
         id: Depcheck
         env:
           JAVA_HOME: /opt/jdk
         with:
           project: ${{github.repository}}
           path: '.'
           format: 'HTML'
-          out: 'reports' # this is the default, no need to specify unless you wish to override it
           args: >
             --suppression ./allow-list.xml
             --failOnCVSS 7
             --enableRetired
-            
+            --exclude **/*-javadoc.jar 
+            --exclude **/*-sources.jar
+            --out ./reports
       - name: Upload Test results
         if: ${{ always() }}
         uses: actions/upload-artifact@v4

.github/workflows/license-scanning-maven.yml

@@ -52,10 +52,10 @@ jobs:
     runs-on: ubuntu-latest
     steps:
     - uses: actions/checkout@v4
-    - name: Set up JDK 17
+    - name: Set up JDK 21
       uses: actions/setup-java@v4
       with:
-        java-version: 17
+        java-version: 21
         cache: maven
         distribution: 'adopt'
     - name: Install XQ
@@ -77,4 +77,4 @@ jobs:
       uses: actions/upload-artifact@v4
       with:
         name: license-xml-report
-        path: './**/${{ env.REPORT_PATH }}'
+        path: './**/${{ env.REPORT_PATH }}'

LICENSE

@@ -186,7 +186,7 @@
       same "printed page" as the copyright notice for easier
       identification within third-party archives.
 
-   Copyright 2025 CLOUDRISK Limited and FT Advisory LLC
+   Copyright 2023-2025 CLOUDRISK Limited and FT Advisory LLC
 
    Licensed under the Apache License, Version 2.0 (the "License");
    you may not use this file except in compliance with the License.

NOTICE

@@ -1,5 +1,5 @@
 Rune Python Generator - FINOS
-Copyright 2025 - 2025 CLOUDRISK Limited ([email protected]) and FT Advisory LLC ([email protected])
+Copyright 2023-2025 CLOUDRISK Limited ([email protected]) and FT Advisory LLC ([email protected])
 
 This product includes software developed at the Fintech Open Source Foundation (https://www.finos.org/).
 

README.md

@@ -1,12 +1,16 @@
-[![FINOS - Incubating](https://cdn.jsdelivr.net/gh/finos/contrib-toolbox@master/images/badge-incubating.svg)](https://community.finos.org/docs/governance/Software-Projects/stages/incubating)
+[![FINOS - Incubating](https://cdn.jsdelivr.net/gh/finos/contrib-toolbox@master/images/badge-incubating.svg)](https://community.finos.org/docs/governance/Software-Projects/stages/incubating)[![OpenSSF Best Practices](https://www.bestpractices.dev/projects/10725/badge)](https://www.bestpractices.dev/projects/10725)[![Maven CI](https://github.com/regnosys/rune-python-generator/actions/workflows/cve-scanning.yml/badge.svg)](https://github.com/regnosys/rune-python-generator/actions/workflows/cve-scanning.yml)
 
-<img align="right" width="40%" src="https://www.finos.org/hubfs/FINOS/finos-logo/FINOS_Icon_Wordmark_Name_RGB_horizontal.png">
+
+<img align="right" width="15%" src="https://www.finos.org/hubfs/FINOS/finos-logo/FINOS_Icon_Wordmark_Name_RGB_horizontal.png">
 
 # Rune Python Generator
 
-This repository creates a generator that will produce Python from a model developed using [Rune](https://github.com/finos/rune-dsl).  The generated Python relies upon the [RunePythonRuntime]() library.
- 
-The Python package requires Python version 3.11+.
+*Rune Python Generator* - the generator enables creation of Python from [Rune](https://github.com/finos/rune-dsl).  It supports the full Rune type syntax, and, as described in [EXPRESSION_SUPPORT.md](./EXPRESSION_SUPPORT.md), expression coverage is comprehensive.  The generator does not yet fully implement function generation.
+
+The generated Python relies upon the [RunePythonRuntime](https://github.com/regnosys/rune-python-runtime) library and requires Python version 3.11+.
+
+## Release Notes
+The features of the current version can be found in the [release notes](./RELEASE.md)
 
 ## Repository Organization
 
@@ -19,19 +23,56 @@ The Python package requires Python version 3.11+.
 - `build/build_cdm.sh` - used to create a Python package from code generated using CDM Rune definitions
 - `test` - Python unit tests and scripts to run the tests
 
-## Installation Steps
+## Development setup
+
+### Setup for developers
+This guide is meant for everyone who wants to contribute to the Rune Python Generator and needs to get things up and running.
+
 Detailed build and testing instructions can be found in [BUILDANDTEST.md](./BUILDANDTEST.md)
 
-A quick overview follows:
+If this guide does not work for you, be sure to raise an issue. This way we can help you figure out what the problem is and update this guide to prevent the same problem for future users.
 
-1. Make a local copy of this repo
-2. Build and test using Maven
-```
-cd rune-python-generator
-mvn -s clean install
+### 1. Building with Maven
+Start by cloning the project: `git clone https://github.com/regnosys/rune-python-generator`
+
+Our project runs with Java 21. Make sure that your Maven also uses this version of Java by running `mvn -v`.
+
+To build the project, run `mvn clean install`.
+
+#### UNIT Testing
+Building the project using Maven will run JUNIT-based unit tests.  All tests should pass.  To run the Python unit tests follow the instructions in [BUILDANDTEST.md](./BUILDANDTEST.md)
+
+### 2. Setting things up in Eclipse
+#### Install Eclipse IDE for Java and DSL Developers
+Install version `2025-06` of the "Eclipse IDE for Java and DSL Developers" using the [Eclipse Installer](https://www.eclipse.org/downloads/packages/installer). You might have to enable "Advanced Mode" in the settings of the Eclipse Installer to install a specific version.
+
+#### Configure Eclipse with the right version of Java
+Xtend files cannot be build with any Java version later than 21. In Eclipse, go to Settings... > Java > Installed JREs and make sure the checked JRE points to a Java version of 21.
+
+#### Install the Checkstyle plugin
+We use [Checkstyle](https://checkstyle.sourceforge.io/) for enforcing good coding practices. The Eclipse plugin for Checkstyle can be found here: [https://checkstyle.org/eclipse-cs/#!/](https://checkstyle.org/eclipse-cs/#!/).
+
+#### Open the project in Eclipse
+Go to Import... > Existing Maven Project, select the right folder, click Finish.
+
+### To Generate CDM from Rune
+
+Use this script to generated the Python version of CDM
+```sh
+build/build_cdm.sh
 ```
-All the tests should pass.
+The script will use the CDM from the branch specified in the file (E.G. master) of the [FINOS Repo](https://github.com/finos/common-domain-model) and generate a wheel in the project directory `target/python-cdm`
+
+To use a different version of CDM, update CDM_VERSION in the script.
+
+## Roadmap
+
+The Roadmap will be aligned to the [Rune-DSL](https://github.com/finos/rune-dsl/) and [CDM](https://github.com/finos/common-domain-model/blob/master/ROADMAP.md) roadmaps.
 
+## Contributors
+- [CLOUDRISK Limited](https://www.cloudrisk.uk), email: [email protected]
+- [FT Advisory LLC](https://www.ftadvisory.co), email: [email protected]
+- [TradeHeader SL](https://www.tradeheader.com), email: [email protected]
 
 ## Contributing
 For any questions, bugs or feature requests please open an [issue](https://github.com/regnosys/rune-python-generator/issues)
@@ -45,29 +86,32 @@ To submit a contribution:
 5. Push to the branch (`git push origin feature/fooBar`)
 6. Create a new Pull Request
 
-# To Generate CDM from Rune
+_NOTE:_ Commits and pull requests to FINOS repositories will only be accepted from those contributors with an active, executed Individual Contributor License Agreement (ICLA) with FINOS OR who are covered under an existing and active Corporate Contribution License Agreement (CCLA) executed with FINOS. Commits from individuals not covered under an ICLA or CCLA will be flagged and blocked by the FINOS Clabot tool (or EasyCLA). Please note that some CCLAs require individuals/employees to be explicitly named on the CCLA.
 
-Use this script to generated the Python version of CDM
-```sh
-build/build_cdm.sh
-```
-The script will use the CDM from the branch specified in the file (E.G. master) of the [FINOS Repo](https://github.com/finos/common-domain-model) and generate a wheel in the project directory `target/python-cdm`
+Unsure if you are covered under an existing CCLA? Email [email protected]*
 
-To use a different version of CDM, update CDM_VERSION in the script.
+## Get in touch with the Rune Python Generator Team
 
-## Contributors
-- [CLOUDRISK Limited](https://www.cloudrisk.uk), email: [email protected]
-- [FT Advisory LLC](https://www.ftadvisory.co), email: [email protected]
-- [TradeHeader SL](https://www.tradeheader.com), email: [email protected]
+ Get in touch with the Rune team by creating a [GitHub issue](https://github.com/REGnosys/rune-python-generator/issues/new) and labelling it with "help wanted".
+
+ We encourage the community to get in touch via the [FINOS Slack](https://www.finos.org/blog/finos-announces-new-community-slack).
 
 ## Governance
 
 This project implements https://community.finos.org/docs/governance/#open-source-software-projects
 
 ## License
 
-Copyright 2019 Fintech Open Source Foundation
+Copyright 2023-2025 CLOUDRISK Limited and FT Advisory LLC
 
 Distributed under the [Apache License, Version 2.0](http://www.apache.org/licenses/LICENSE-2.0).
 
 SPDX-License-Identifier: [Apache-2.0](https://spdx.org/licenses/Apache-2.0)
+
+## Contributors
+
+- [CLOUDRISK Limited](https://www.cloudrisk.uk), email: [email protected]
+- [FT Advisory LLC](https://www.ftadvisory.co), email: [email protected]
+- [TradeHeader SL](https://www.tradeheader.com), email: [email protected]
+
+SPDX-License-Identifier: [Apache-2.0](https://spdx.org/licenses/Apache-2.0)

allow-list.xml

@@ -16,23 +16,11 @@
   -->
 
 <suppressions xmlns="https://jeremylong.github.io/DependencyCheck/dependency-suppression.1.3.xsd">
-   <suppress>
-      <notes><![CDATA[
-      This CVE only affects projects fetching p2 repo's over HTTP, but we use HTTPS.
-      ]]></notes>
-      <cve>CVE-2021-41033</cve>
-   </suppress>
-   <suppress>
-	  <notes><![CDATA[
-	  We are using Reload4j, which is a secure drop-in replacement for log4j.
-	  ]]></notes>
-	  <cve>CVE-2020-9493</cve>
-	</suppress>
 	<suppress>
-	   <notes><![CDATA[
-	   We are using Reload4j, which is a secure drop-in replacement for log4j.
-	   ]]></notes>
-	   <cve>CVE-2022-23307</cve>
+      	    <notes><![CDATA[
+      	    This CVE only affects projects fetching p2 repo's over HTTP, but we use HTTPS.
+      	    ]]></notes>
+      	    <cve>CVE-2021-41033</cve>
 	</suppress>
 	<suppress>
 	   <notes><![CDATA[
@@ -47,36 +35,4 @@
 	   ]]></notes>
 	   <cve>CVE-2019-10249</cve>
 	</suppress>
-	<suppress>
-	   <notes><![CDATA[
-	   Calling the method `com.google.common.io.Files.createTempDir` is a vulnerability,
-	   but we do not call it.
-	   ]]></notes>
-	   <cve>CVE-2020-8908</cve>
-	</suppress>
-	<suppress>
-	   <notes><![CDATA[
-	   We are not creating SVG's with Batik of Apache XML Graphics.
-	   ]]></notes>
-	   <cve>CVE-2022-41704</cve>
-	</suppress>
-	<suppress>
-	   <notes><![CDATA[
-	   We are not creating SVG's with Batik of Apache XML Graphics.
-	   ]]></notes>
-	   <cve>CVE-2022-42890</cve>
-	</suppress>
-	<suppress>
-	   	<notes><![CDATA[
-	   This CVE is not about org.eclipse.e4.emf.xpath. It seems the check is
-	   too loose.
-	   ]]></notes>
-	   <cve>CVE-2022-41852</cve>
-	</suppress>
-	<suppress>
-	   <notes><![CDATA[
-	   This only affects milestone and RC versions, but we use a stable release.
-	   ]]></notes>
-	   <cve>CVE-2020-15824</cve>
-	</suppress>
-</suppressions>
+</suppressions>

build/build_cdm.sh

@@ -1,4 +1,11 @@
 #!/bin/bash
+#
+# utility script - builds CDM using PythonFilesGeneratorTest::generateCDMPythonFromRosetta
+# to use:
+# 1. remove disabled test by commenting @Disabled
+# 2. specify which version of CDM to pull in get_cdm.sh
+# 3. run this script
+#
 function error
 {
     echo

build/get_cdm.sh

@@ -1,4 +1,9 @@
 #!/bin/bash
+#
+# utility script - pulls the version of CDM specified by CDM_VERSION 
+# supports build_cdm.sh
+#
+
 function error
 {
     echo

pom.xml

@@ -154,7 +154,7 @@
 
         <apache.commons.lang.version>3.13.0</apache.commons.lang.version>
         <apache.commons.text.version>1.11.0</apache.commons.text.version>
-        <commons-io.version>2.11.0</commons-io.version>
+        <commons-io.version>2.19.0</commons-io.version>
         <guava.version>32.0.1-jre</guava.version>
 
         <!-- Release -->
@@ -163,7 +163,7 @@
         <stagingTimeoutInMinutes>20</stagingTimeoutInMinutes>
 
         <rosetta.dsl.version>9.54.0</rosetta.dsl.version>   
-        <rosetta.bundle.version>11.63.1</rosetta.bundle.version>
+        <rosetta.bundle.version>11.64.0</rosetta.bundle.version>
 
         <xtext.version>2.38.0</xtext.version>
         <guice.version>6.0.0</guice.version>
@@ -386,19 +386,15 @@
             <groupId>org.eclipse.emf</groupId>
             <artifactId>org.eclipse.emf.codegen.ecore</artifactId>
         </dependency>
-        <dependency>
-            <groupId>com.google.inject</groupId>
-            <artifactId>guice</artifactId>
-        </dependency>
         <dependency>
             <groupId>org.apache.maven</groupId>
             <artifactId>maven-model</artifactId>
-            <version>3.3.9</version>
+            <version>3.9.10</version>
         </dependency>
         <dependency>
             <groupId>org.apache.commons</groupId>
             <artifactId>commons-configuration2</artifactId>
-            <version>2.8.0</version>
+            <version>2.12.0</version>
         </dependency>
         <!-- migrated from Python POM: end -->
     </dependencies>