Replace legacy Alpine Config entirely with MicroProfile Config

[nscuro]

Description

Replaces legacy Alpine Config entirely with MicroProfile Config.

Addressed Issue

N/A

Additional Details

See included ADR.

Docs PR: DependencyTrack/docs#22

Checklist

• I have read and understand the contributing guidelines
• This PR fixes a defect, and I have provided tests to verify that the fix is effective
• This PR implements an enhancement, and I have provided tests to verify that it works as intended
• This PR introduces changes to the database model, and I have updated the migration changelog accordingly
• This PR introduces new or alters existing behavior, and I have updated the documentation accordingly
• This PR is a substantial change (per the ADR criteria), and I have added an ADR under docs/adr/

[codacy-production]

Up to standards ✅

🟢 Issues 1 minor

Results:
1 new issue

Category	Results
CodeStyle	1 minor

View in Codacy

🟢 Metrics 8 complexity

Metric	Results
Complexity	8

View in Codacy

🟢 Coverage 74.18% diff coverage

Metric	Results
Coverage variation	Report missing for cad1d761
Diff coverage	✅ 74.18% diff coverage (70.00%)

View coverage diff in Codacy

Coverage variation details

	Coverable lines	Covered lines	Coverage
Common ancestor commit (cad1d76)	Report Missing	Report Missing	Report Missing
Head commit (68acead)	41811	35144	84.05%

Coverage variation is the difference between the coverage for the head and common ancestor commits of the pull request branch: <coverage of head commit> - <coverage of common ancestor commit>

Diff coverage details

	Coverable lines	Covered lines	Diff coverage
Pull request (#2042)	182	135	74.18%

Diff coverage is the percentage of lines that are covered by tests out of the coverable lines that the pull request added or modified: <covered lines added or modified>/<coverable lines added or modified> * 100%

¹ Codacy didn't receive coverage data for the commit, or there was an error processing the received data. Check your integration for errors and validate that your coverage setup is correct.

_{NEW Get contextual insights on your PRs based on Codacy's metrics, along with PR and Jira context, without leaving GitHub. Enable AI reviewer
TIP This summary will be updated as you push new changes.}

[Copilot]

Pull request overview

This PR completes the migration away from the legacy Alpine Config facade by moving configuration access across the codebase to MicroProfile / SmallRye Config, including a new standardized file-secret mechanism and removal of the alpine-test module.

Changes:

• Remove legacy Alpine config/test utilities and replace enum-based config keys with string constants (AlpineConfigKeys, ConfigKeys) backed by MicroProfile config defaults.
• Add a SmallRye SecretKeysHandler implementation to support ${file::/path} secret expressions and enforce fail-fast startup on legacy *.file properties.
• Update application/runtime code and unit tests to use ConfigProvider, SmallRyeConfigBuilder, and MemoryConfigSource instead of Alpine config/test helpers.

Reviewed changes

Copilot reviewed 76 out of 76 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
support/smallrye-config-secret-handler-file/src/test/java/org/dependencytrack/support/config/secret/file/FileSecretKeysHandlerFactoryTest.java	Adds tests for ${file::...} secret decoding behavior.
support/smallrye-config-secret-handler-file/src/main/resources/META-INF/services/io.smallrye.config.SecretKeysHandlerFactory	Registers the secret handler via ServiceLoader SPI.
support/smallrye-config-secret-handler-file/src/main/java/org/dependencytrack/support/config/secret/file/FileSecretKeysHandlerFactory.java	Implements file-based SecretKeysHandler for ${file::/path}.
support/smallrye-config-secret-handler-file/pom.xml	Introduces new support module for the secret handler.
pom.xml	Adds the new support module to the multi-module build.
plugin/runtime/src/test/java/org/dependencytrack/plugin/runtime/DeploymentConfigImplTest.java	Updates tests to use a real SmallRye Config instead of mocking.
plugin/runtime/src/test/java/org/dependencytrack/plugin/runtime/ConfigRegistryImplTest.java	Uses a SmallRye config instance instead of mocks throughout tests.
docs/adr/018-dissolve-alpine-config.md	ADR documenting the removal of Alpine config and new secret mechanism.
coverage-report/pom.xml	Drops alpine-test and adds new secret-handler module to coverage build deps.
common/config/pom.xml	Adds runtime dependency on the file secret handler.
apiserver/src/test/java/org/dependencytrack/secret/SecretManagerInitializerTest.java	Updates test config construction to SmallRye builder.
apiserver/src/test/java/org/dependencytrack/resources/v1/FindingResourceTest.java	Replaces alpine.Config build info access with MP Config lookups.
apiserver/src/test/java/org/dependencytrack/persistence/DatabaseMigrationInitTaskTest.java	Replaces alpine-test property helpers with MemoryConfigSource.
apiserver/src/test/java/org/dependencytrack/integrations/FindingPackagingFormatTest.java	Replaces alpine.Config build info access with MP Config lookups.
apiserver/src/test/java/org/dependencytrack/common/config/LegacyPropertyFallbackCustomizerTest.java	Adds integration-style tests for legacy alpine.* fallback behavior.
apiserver/src/test/java/org/dependencytrack/ResourceTest.java	Removes Alpine unit-test enablement (legacy).
apiserver/src/test/java/org/dependencytrack/PersistenceCapableTest.java	Removes Alpine unit-test enablement (legacy).
apiserver/src/main/java/org/dependencytrack/util/TaskUtil.java	Migrates task scheduling config reads to MP Config keys/optionals.
apiserver/src/main/java/org/dependencytrack/util/LockProvider.java	Removes legacy unit-test handling and refactors lock executor creation.
apiserver/src/main/java/org/dependencytrack/tasks/TaskSchedulerInitializer.java	Switches hard-coded strings to ConfigKeys constants.
apiserver/src/main/java/org/dependencytrack/secret/SecretManagerInitializer.java	Switches provider key lookup to ConfigKeys.
apiserver/src/main/java/org/dependencytrack/policy/vulnerability/SyncVulnPolicyBundleActivity.java	Switches bundle/auth config keys to ConfigKeys.
apiserver/src/main/java/org/dependencytrack/persistence/DatabaseSeedingInitTask.java	Replaces build-info config mapping usage with direct key lookups.
apiserver/src/main/java/org/dependencytrack/parser/cyclonedx/util/ModelConverter.java	Replaces alpine.Config build info access with MP Config lookups.
apiserver/src/main/java/org/dependencytrack/observability/ManagementServer.java	Switches metrics config reads to ConfigKeys.
apiserver/src/main/java/org/dependencytrack/notification/NotificationSubsystemInitializer.java	Switches outbox relay config reads to ConfigKeys.
apiserver/src/main/java/org/dependencytrack/model/ConfigPropertyConstants.java	Switches telemetry default key lookup to ConfigKeys.
apiserver/src/main/java/org/dependencytrack/filestorage/FileStorageInitializer.java	Switches file-storage provider key lookup to ConfigKeys.
apiserver/src/main/java/org/dependencytrack/event/EventSubsystemInitializer.java	Switches worker drain timeout key lookup to ConfigKeys.
apiserver/src/main/java/org/dependencytrack/dex/DexEngineInitializer.java	Switches notification threshold key lookup to ConfigKeys.
apiserver/src/main/java/org/dependencytrack/dev/DevServices.java	Replaces legacy ConfigKey enum usage with string constants.
apiserver/src/main/java/org/dependencytrack/common/HttpClient.java	Switches HTTP timeout key lookup to AlpineConfigKeys.
apiserver/src/main/java/org/dependencytrack/common/ConfigKeys.java	Adds centralized string constants for apiserver-owned config keys.
apiserver/src/main/java/org/dependencytrack/common/ConfigKey.java	Removes legacy enum-based config key wrapper.
apiserver/src/main/java/org/dependencytrack/common/ClusterInfo.java	Removes legacy unit-test special casing tied to Alpine config.
apiserver/src/main/java/org/dependencytrack/cache/CacheManagerInitializer.java	Switches cache provider key lookup to ConfigKeys.
apiserver/src/main/java/org/dependencytrack/Application.java	Enforces fail-fast on legacy *.file secrets; adds build-info gauge; switches many keys to ConfigKeys.
apiserver/pom.xml	Removes alpine-test and adds smallrye-config-source-memory for tests.
alpine/pom.xml	Removes the alpine-test module from Alpine reactor build.
alpine/alpine-test/src/test/resources/alpine.version	Removes legacy Alpine test artifact resources.
alpine/alpine-test/src/test/java/alpine/test/config/ConfigPropertyExtensionTest.java	Removes legacy Alpine test utilities.
alpine/alpine-test/src/main/java/alpine/test/config/WithConfigProperty.java	Removes legacy Alpine test utilities.
alpine/alpine-test/src/main/java/alpine/test/config/ConfigPropertyExtension.java	Removes legacy Alpine test utilities.
alpine/alpine-test/pom.xml	Removes alpine-test module POM.
alpine/alpine-server/src/test/resources/application.properties	Sets dt.config.profile=test for Alpine server tests.
alpine/alpine-server/src/test/java/alpine/server/filters/SessionUsageTrackerTest.java	Removes legacy Alpine unit-test enablement calls.
alpine/alpine-server/src/test/java/alpine/server/filters/AuthorizationFilterTest.java	Removes legacy Alpine unit-test enablement calls.
alpine/alpine-server/src/test/java/alpine/server/auth/SessionTokenAuthenticationServiceTest.java	Removes legacy Alpine unit-test enablement calls.
alpine/alpine-server/src/test/java/alpine/server/auth/OidcAuthenticationServiceTest.java	Refactors tests to use SmallRye config instead of alpine.Config mocking.
alpine/alpine-server/src/test/java/alpine/server/auth/ManagedUserAuthenticationServiceTest.java	Removes legacy Alpine unit-test enablement calls.
alpine/alpine-server/src/test/java/alpine/server/auth/ApiKeyAuthenticationServiceTest.java	Removes legacy Alpine unit-test enablement calls.
alpine/alpine-server/src/main/java/alpine/server/util/OidcUtil.java	Switches to MP Config and AlpineConfigKeys.
alpine/alpine-server/src/main/java/alpine/server/persistence/PersistenceManagerFactory.java	Replaces Config.isUnitTestsEnabled() with profile-based test detection.
alpine/alpine-server/src/main/java/alpine/server/filters/HeaderFilter.java	Switches to MP Config reads for build info and CORS settings.
alpine/alpine-server/src/main/java/alpine/server/auth/PasswordService.java	Switches bcrypt rounds config to MP Config key.
alpine/alpine-server/src/main/java/alpine/server/auth/OidcConfigurationResolver.java	Switches to MP Config keys for OIDC resolver defaults.
alpine/alpine-server/src/main/java/alpine/server/auth/OidcAuthenticationService.java	Switches Alpine config access to MP Config key lookups.
alpine/alpine-server/src/main/java/alpine/server/auth/LdapConnectionWrapper.java	Switches LDAP config access to MP Config key lookups.
alpine/alpine-server/src/main/java/alpine/server/auth/LdapAuthenticationService.java	Updates warning message to reference MP config key constant.
alpine/alpine-server/src/main/java/alpine/server/auth/DefaultOidcAuthenticationCustomizer.java	Switches to MP Config for claim name resolution.
alpine/alpine-server/src/main/java/alpine/server/auth/Authenticator.java	Switches LDAP enabled check to MP Config key constant.
alpine/alpine-server/src/main/java/alpine/server/AlpineServlet.java	Switches startup/shutdown logging to MP Config build-info keys.
alpine/alpine-model/src/main/java/alpine/model/ApiKey.java	Switches API key prefix to MP Config key constant.
alpine/alpine-model/src/main/java/alpine/model/About.java	Switches build-info fields to MP Config keys and removes legacy system UUID access.
alpine/alpine-infra/src/main/java/alpine/event/framework/EventService.java	Updates Javadoc references to new config keys.
alpine/alpine-common/src/test/resources/Config_testGetValue.properties	Removes legacy Alpine config test resource.
alpine/alpine-common/src/test/java/alpine/common/util/ProxyUtilTest.java	Refactors tests to use SmallRye config instead of mocking Alpine config.
alpine/alpine-common/src/test/java/alpine/ConfigTest.java	Removes legacy Alpine Config tests.
alpine/alpine-common/src/main/resources/META-INF/microprofile-config.properties	Adds default values for former Alpine config keys via MP config.
alpine/alpine-common/src/main/java/alpine/config/AlpineConfigKeys.java	Introduces string constants for former Alpine config keys.
alpine/alpine-common/src/main/java/alpine/common/util/ThreadUtil.java	Switches worker thread sizing to MP Config key lookups.
alpine/alpine-common/src/main/java/alpine/common/util/ProxyUtil.java	Switches proxy config access to MP Config key lookups.
alpine/alpine-common/src/main/java/alpine/common/config/ConfigUtil.java	Removes config-mapping helper now that legacy facade is gone.
alpine/alpine-common/src/main/java/alpine/common/config/ConfigBuilderCustomizer.java	Updates builder customization to rely on MP defaults/properties rather than mappings.
alpine/alpine-common/src/main/java/alpine/common/config/BuildInfoConfig.java	Removes build-info config mapping interface.
alpine/alpine-common/src/main/java/alpine/Config.java	Removes legacy Alpine Config singleton entirely.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.