Make JAR, not WAR!

[nscuro]

Description

Switches from an executable WAR distribution to normal JAR one. Instead of shading dependencies, ships them as separate JARs in a lib directory. This is a better fit for container because it allows for more effective layer caching.

The build is faster because the expensive WAR overlays are no longer required.

The development setup also becomes less involved, as it removes the need to go through the Jetty Maven plugin.

Addressed Issue

N/A

Additional Details

N/A

Checklist

• I have read and understand the contributing guidelines
• This PR fixes a defect, and I have provided tests to verify that the fix is effective
• This PR implements an enhancement, and I have provided tests to verify that it works as intended
• This PR introduces changes to the database model, and I have updated the migration changelog accordingly
• This PR introduces new or alters existing behavior, and I have updated the documentation accordingly

[Copilot]

Pull request overview

This PR migrates the API server distribution from an executable WAR to a thin JAR plus a lib/ directory of dependencies, aiming to improve container layer caching and simplify development/runtime by removing the WAR overlay + Jetty Maven plugin approach.

Changes:

• Switch apiserver packaging from war to jar and introduce dependency copying to target/lib/.
• Replace web.xml / Jetty context XML configuration with a Java entrypoint that bootstraps an embedded Jetty server and serves static resources from the classpath.
• Update Docker build and GitHub workflows to publish/use the new JAR + lib/ layout.

Reviewed changes

Copilot reviewed 18 out of 20 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
coverage-report/pom.xml	Stops depending on the classes classifier now that apiserver is a normal JAR.
apiserver/src/main/webapp/WEB-INF/web.xml	Removed legacy WAR-based servlet/filter/listener configuration.
apiserver/src/main/webapp/WEB-INF/jetty-context.xml	Removed Jetty XML customization used by the WAR-based setup.
apiserver/src/main/resources/static/index.html	Adds a simple static landing page and links (now served from the JAR).
apiserver/src/main/java/org/dependencytrack/parser/spdx/json/SpdxLicenseDetailParser.java	Adjusts license data loading to work from a JAR filesystem as well as from directories.
apiserver/src/main/java/org/dependencytrack/Application.java	New embedded Jetty bootstrap replacing executable WAR entrypoint.
apiserver/src/main/docker/create-jre.sh	Updates jdeps analysis to use thin JAR + lib/* rather than exploded WAR contents.
apiserver/src/main/docker/Dockerfile	Copies target/lib/ into the image and runs the app from a classpath instead of -jar.
apiserver/pom.xml	Switches packaging to JAR, configures JAR manifest main class/classpath, and adds dependency copying to target/lib.
apiserver/.dockerignore	Allows inclusion of nested target/**.jar files (for target/lib/ contents).
alpine/pom.xml	Removes the alpine-executable-war module from the build.
alpine/alpine-executable-war/src/main/resources/jetty-logging.properties	Deleted along with removal of the executable WAR module.
alpine/alpine-executable-war/src/main/resources/alpine-executable-war.version	Deleted along with removal of the executable WAR module.
alpine/alpine-executable-war/src/main/java/alpine/embedded/EmbeddedJettyServer.java	Deleted executable-WAR Jetty bootstrap.
alpine/alpine-executable-war/src/main/java/alpine/embedded/CliArgs.java	Deleted CLI argument parser used by executable WAR entrypoint.
alpine/alpine-executable-war/pom.xml	Deleted the executable WAR helper module POM.
.mvn/maven-build-cache-config.xml	Updates build-cache config to run the new dependency-copy execution.
.idea/runConfigurations/Jetty.xml	Removes IntelliJ Jetty Maven run configuration tied to the old setup.
.github/workflows/ci-publish.yaml	Renames artifact set from WARs to JARs for publishing pipeline.
.github/workflows/_meta-build.yaml	Uploads/downloads JAR + lib/ artifacts instead of WAR-focused artifacts.

Files not reviewed (1)

• .idea/runConfigurations/Jetty.xml: Language not supported

Comments suppressed due to low confidence (1)

apiserver/src/main/java/org/dependencytrack/parser/spdx/json/SpdxLicenseDetailParser.java:55

• SpdxLicenseDetailParser.parse() now wraps IOException in UncheckedIOException, but callers (e.g. database seeding) only catch IOException. A read failure will bypass the catch block and surface as an unexpected runtime exception. Consider keeping checked IO semantics here (e.g., let parse(...) throw IOException and adapt the stream mapping to rethrow as IOException, or catch UncheckedIOException in getLicenseDefinitions() and wrap it back into IOException).

    private static License parse(final Path path) {
        try {
            final byte[] jdon = Files.readAllBytes(path);
            final ObjectMapper objectMapper = new ObjectMapper();
            return objectMapper.readValue(jdon, License.class);
        } catch (IOException e) {
            throw new UncheckedIOException(e);
        }
    }

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 19 out of 21 changed files in this pull request and generated 2 comments.

Files not reviewed (1)

• .idea/runConfigurations/Jetty.xml: Language not supported

Comments suppressed due to low confidence (1)

apiserver/src/main/docker/create-jre.sh:76

• create-jre.sh writes module-deps.txt into the working directory and never removes it. In Docker builds this ends up baked into the image layer (small but unnecessary) and can also confuse local runs of the script. Consider writing to a temp file (e.g., via mktemp) and/or deleting it at the end of the script.

echo '[+] detecting module dependencies'
jdeps \
  --class-path "lib/*" \
  --print-module-deps \
  --ignore-missing-deps \
  --multi-release 21 \
  "${input_jar}" \
  > module-deps.txt

module_deps="$(cat module-deps.txt),${static_module_deps}"

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[codacy-production]

Coverage summary from Codacy

See diff coverage on Codacy

Coverage variation	Diff coverage
Report missing for a1b14b21	❌ 11.11% (target: 70.00%)

Coverage variation details

	Coverable lines	Covered lines	Coverage
Common ancestor commit (a1b14b2)	Report Missing	Report Missing	Report Missing
Head commit (0ae985b)	39707	33276	83.80%

Coverage variation is the difference between the coverage for the head and common ancestor commits of the pull request branch: <coverage of head commit> - <coverage of common ancestor commit>

Diff coverage details

	Coverable lines	Covered lines	Diff coverage
Pull request (#1839)	117	13	11.11%

Diff coverage is the percentage of lines that are covered by tests out of the coverable lines that the pull request added or modified: <covered lines added or modified>/<coverable lines added or modified> * 100%

See your quality gate settings    Change summary preferences

Footnotes

1. Codacy didn't receive coverage data for the commit, or there was an error processing the received data. Check your integration for errors and validate that your coverage setup is correct. ↩