Groovy 5.0.x support for Grails 8 + Spring Boot 4

.github/scripts/groovy-joint-build.init.gradle

@@ -0,0 +1,56 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements.  See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License.  You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+// Gradle init-script applied during the Groovy joint-validation build.
+// Overrides Develocity and build-cache configuration injected by Groovy's own
+// build-scans.gradle without modifying any of Groovy's source files.
+//
+// Applied via: ./gradlew --init-script <path>/groovy-joint-build.init.gradle
+//
+// Defensive: the pluginManager.withPlugin guard makes this a no-op when the
+// Develocity plugin is absent, so the script never crashes Groovy's build.
+
+settingsEvaluated { settings ->
+    settings.pluginManager.withPlugin('com.gradle.develocity') {
+        def isAuthenticated = System.getenv('GRAILS_DEVELOCITY_ACCESS_KEY') != null
+
+        // 'develocity' is the DSL extension registered by the plugin on Settings.
+        settings.develocity {
+            server = 'https://develocity.apache.org'
+
+            buildScan {
+                // Tag the build for visibility on develocity.apache.org. Groovy's own
+                // gradle/build-scans.gradle does not add any tags, so additive is safe.
+                tag('groovy')
+                tag('grails-core')
+                // Only publish when a valid access key is present in the environment.
+                publishing.onlyIf { isAuthenticated }
+                uploadInBackground = false
+            }
+        }
+
+        settings.buildCache {
+            local {
+                enabled = false
+            }
+            remote(settings.develocity.buildCache) {
+                push = isAuthenticated
+                enabled = true
+            }
+        }
+    }
+}

.github/workflows/codeql.yml

@@ -69,26 +69,12 @@ jobs:
       uses: github/codeql-action/init@7211b7c8077ea37d8641b6271f6a365a22a5fbfa # v4.36.0
       with:
         languages: ${{ matrix.language }}
+        # The autobuild action runs `./gradlew testClasses`, which compiles Groovy sample apps that are covered by regular CI.
+        build-mode: none
         # If you wish to specify custom queries, you can do so here or in a config file.
         # By default, queries listed here will override any specified in a config file.
         # Prefix the list here with "+" to use these queries and those in the config file.
         # queries: ./path/to/local/query, your-org/your-repo/queries@main
 
-    # Autobuild attempts to build any compiled languages  (C/C++, C#, or Java).
-    # If this step fails, then you should remove it and run the build manually (see below)
-    - name: Autobuild
-      uses: github/codeql-action/autobuild@7211b7c8077ea37d8641b6271f6a365a22a5fbfa # v4.36.0
-
-    # ℹ️ Command-line programs to run using the OS shell.
-    # 📚 See https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#jobsjob_idstepsrun
-
-    # ✏️ If the Autobuild fails above, remove it and uncomment the following three lines
-    #    and modify them (or add more) to build your code if your project
-    #    uses a compiled language
-
-    #- run: |
-    #   make bootstrap
-    #   make release
-
     - name: Perform CodeQL Analysis
       uses: github/codeql-action/analyze@7211b7c8077ea37d8641b6271f6a365a22a5fbfa # v4.36.0

.github/workflows/groovy-joint-workflow.yml

@@ -47,23 +47,40 @@ jobs:
         with:
           path: ~/.m2/repository
           key: cache-local-maven-${{ github.sha }}
-      - name: "📥 Checkout Grails Core to fetch Gradle Plugin versions it uses"
+      - name: "📥 Checkout Grails Core files needed for the Groovy joint-build"
+        # Sparse-checkout fetches only the two paths this job actually needs:
+        #   - dependencies.gradle: parsed below to derive the matching Apache
+        #     Groovy branch (GROOVY_<major>_0_X) for this Grails branch.
+        #   - .github/scripts/groovy-joint-build.init.gradle: passed to
+        #     ./gradlew --init-script when publishing Groovy to local Maven so
+        #     the joint build reuses our Develocity / build-cache settings.
+        # Both paths must be listed here; otherwise the init-script step fails
+        # with "The specified initialization script ... does not exist."
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           sparse-checkout-cone-mode: false
-          sparse-checkout: settings.gradle
-      - name: "📝 Store the Gradle Plugin versions used in this project"
-        id: gradle-plugin-versions
+          sparse-checkout: |
+            dependencies.gradle
+            .github/scripts/groovy-joint-build.init.gradle
+      - name: "📝 Derive matching Apache Groovy branch from dependencies.gradle"
+        id: groovy-branch
         run: |
-          DEVELOCITY_PLUGIN_VERSION=$(grep -m 1 'id\s*\(\"com.gradle.develocity\"\|'"'com.gradle.develocity'"'\)\s*version' settings.gradle | sed -E "s/.*version[[:space:]]*['\"]?([0-9]+\.[0-9]+(\.[0-9]+)?)['\"]?.*/\1/" | tr -d [:space:])
-          COMMON_CUSTOM_USER_DATA_PLUGIN_VERSION=$(grep -m 1 'id\s*\(\"com.gradle.common-custom-user-data-gradle-plugin\"\|'"'com.gradle.common-custom-user-data-gradle-plugin'"'\)\s*version' settings.gradle | sed -E "s/.*version[[:space:]]*['\"]?([0-9]+\.[0-9]+(\.[0-9]+)?)['\"]?.*/\1/" | tr -d [:space:])
-          echo "Project uses Develocity Plugin version: $DEVELOCITY_PLUGIN_VERSION"
-          echo "Project uses Common Custom User Data Plugin version: $COMMON_CUSTOM_USER_DATA_PLUGIN_VERSION"
-          echo "develocity_plugin_version=$DEVELOCITY_PLUGIN_VERSION" >> $GITHUB_OUTPUT
-          echo "common_custom_user_data_plugin_version=$COMMON_CUSTOM_USER_DATA_PLUGIN_VERSION" >> $GITHUB_OUTPUT
-          rm settings.gradle
-      - name: "📥 Checkout Groovy 4_0_X (Grails 7 and later)"
-        run: git clone --depth 1 https://github.com/apache/groovy.git -b GROOVY_4_0_X --single-branch
+          # Extract the major version of `groovy.version` declared in this branch's
+          # dependencies.gradle (e.g. '5.0.5' -> '5', '4.0.31' -> '4') and use it to
+          # pick the matching Apache Groovy development branch (GROOVY_<major>_0_X).
+          # This keeps `7.0.x` PRs validating against Groovy 4 and `8.0.x` PRs
+          # validating against Groovy 5 without hard-coding the branch here.
+          GROOVY_MAJOR=$(grep -m 1 "'groovy\.version'" dependencies.gradle | sed -E "s/.*'([0-9]+)\.[0-9]+\.[0-9]+.*/\1/" | tr -d '[:space:]')
+          if [ -z "$GROOVY_MAJOR" ]; then
+            echo "::error::Could not determine Apache Groovy major version from dependencies.gradle"
+            exit 1
+          fi
+          GROOVY_BRANCH="GROOVY_${GROOVY_MAJOR}_0_X"
+          echo "Validating against Apache Groovy branch: $GROOVY_BRANCH"
+          echo "value=$GROOVY_BRANCH" >> $GITHUB_OUTPUT
+          rm dependencies.gradle
+      - name: "📥 Checkout Apache Groovy (${{ steps.groovy-branch.outputs.value }})"
+        run: git clone --depth 1 https://github.com/apache/groovy.git -b ${{ steps.groovy-branch.outputs.value }} --single-branch
       - name: "🐘 Setup Gradle"
         uses: gradle/actions/setup-gradle@50e97c2cd7a37755bbfafc9c5b7cafaece252f6e # v6.1.0
         with:
@@ -78,54 +95,11 @@ jobs:
           GROOVY_VERSION=$(cat gradle.properties | grep groovyVersion | cut -d\= -f2 |  tr -d '[:space:]')
           echo "Groovy version $GROOVY_VERSION stored"
           echo "value=$GROOVY_VERSION" >> $GITHUB_OUTPUT
-      - name: "🐘 Configure Gradle Plugins (Step 1/3)"
-        id: develocity-conf-1
-        run: |
-          echo "VALUE<<EOF" >> $GITHUB_OUTPUT
-          echo "plugins { " >> $GITHUB_OUTPUT
-          echo "    id 'com.gradle.develocity' version '${{ steps.gradle-plugin-versions.outputs.develocity_plugin_version }}'" >> $GITHUB_OUTPUT 
-          echo "    id 'com.gradle.common-custom-user-data-gradle-plugin' version '${{ steps.gradle-plugin-versions.outputs.common_custom_user_data_plugin_version }}'" >> $GITHUB_OUTPUT 
-          echo "}" >> $GITHUB_OUTPUT 
-          echo "" >> $GITHUB_OUTPUT 
-          echo "EOF" >> $GITHUB_OUTPUT
-      - name: "🐘 Configure Gradle Plugins (Step 2/3)"
-        id: develocity-conf-2
-        run: |
-          echo "VALUE<<EOF" >> $GITHUB_OUTPUT
-          echo "def isAuthenticated = System.getenv('DEVELOCITY_ACCESS_KEY ') != null" >> $GITHUB_OUTPUT
-          echo "develocity {" >> $GITHUB_OUTPUT
-          echo "    server = 'https://develocity.apache.org'" >> $GITHUB_OUTPUT
-          echo "    buildScan {" >> $GITHUB_OUTPUT
-          echo "        tag('groovy')" >> $GITHUB_OUTPUT
-          echo "        tag('grails-core')" >> $GITHUB_OUTPUT
-          echo "        publishing.onlyIf { isAuthenticated }" >> $GITHUB_OUTPUT
-          echo "        uploadInBackground = false" >> $GITHUB_OUTPUT
-          echo "    }" >> $GITHUB_OUTPUT
-          echo "}" >> $GITHUB_OUTPUT
-          echo "buildCache {" >> $GITHUB_OUTPUT
-          echo "    local { enabled = false }" >> $GITHUB_OUTPUT
-          echo "    remote(develocity.buildCache) {" >> $GITHUB_OUTPUT
-          echo "        push = isAuthenticated" >> $GITHUB_OUTPUT
-          echo "        enabled = true" >> $GITHUB_OUTPUT
-          echo "    }" >> $GITHUB_OUTPUT
-          echo "}" >> $GITHUB_OUTPUT
-          echo "" >> $GITHUB_OUTPUT
-          echo "EOF" >> $GITHUB_OUTPUT
-      - name: "🐘 Configure Gradle Plugins (step 3/3)"
-        run: |
-          cd groovy
-          # Delete existing plugins from settings.gradle file
-          sed -i '32,37d' settings.gradle
-          # Add Develocity setup related configuration after line no 31 in settings.gradle
-          echo "${{ steps.develocity-conf-1.outputs.value }}" | sed -i -e "31r /dev/stdin" settings.gradle
-          # Delete existing buildCache configuration from gradle/build-scans.gradle file
-          sed -i '23,46d' gradle/build-scans.gradle
-          # Add Develocity setup related configuration after line no 22 in gradle/build-scans.gradle
-          echo "${{ steps.develocity-conf-2.outputs.value }}" | sed -i -e "22r /dev/stdin" gradle/build-scans.gradle
       - name: "🔨 Publish Groovy to local maven repository (no docs)"
         run: |
           cd groovy
-          ./gradlew pTML -x groovydoc -x javadoc -x javadocAll -x groovydocAll -x asciidoc -x docGDK
+          ./gradlew pTML -x groovydoc -x javadoc -x javadocAll -x groovydocAll -x asciidoc -x docGDK \
+            --init-script $GITHUB_WORKSPACE/.github/scripts/groovy-joint-build.init.gradle
   build_grails:
     needs: [build_groovy]
     runs-on: ubuntu-latest

build-logic/plugins/src/main/groovy/org/apache/grails/buildsrc/SbomPlugin.groovy

@@ -92,15 +92,25 @@ class SbomPlugin implements Plugin<Project> {
     ]
 
     private static Map<String, String> LICENSE_MAPPING = [
-            'pkg:maven/org.antlr/antlr4-runtime@4.7.2?type=jar'               : 'BSD-3-Clause', // maps incorrectly because of https://github.com/CycloneDX/cyclonedx-core-java/issues/205
-            'pkg:maven/jline/jline@2.14.6?type=jar'                           : 'BSD-2-Clause', // maps incorrectly because of https://github.com/CycloneDX/cyclonedx-core-java/issues/205
-            'pkg:maven/org.jline/jline@3.30.6?type=jar'                       : 'BSD-3-Clause', // maps incorrectly because of https://github.com/CycloneDX/cyclonedx-core-java/issues/205
-            'pkg:maven/org.liquibase.ext/liquibase-hibernate5@4.27.0?type=jar': 'Apache-2.0', // maps incorrectly because of https://github.com/liquibase/liquibase/issues/2445 & the base pom does not define a license
             'pkg:maven/com.oracle.coherence.ce/coherence-bom@25.03.1?type=pom': 'UPL-1.0', // does not have map based on license id
             'pkg:maven/com.oracle.coherence.ce/coherence-bom@25.03.2?type=pom': 'UPL-1.0', // does not have map based on license id
             'pkg:maven/com.oracle.coherence.ce/coherence-bom@22.06.2?type=pom': 'UPL-1.0', // does not have map based on license id
+            'pkg:maven/jline/jline@2.14.6?type=jar'                           : 'BSD-2-Clause', // maps incorrectly because of https://github.com/CycloneDX/cyclonedx-core-java/issues/205
             'pkg:maven/opensymphony/sitemesh@2.6.0?type=jar'                  : 'OpenSymphony', // custom license approved by legal LEGAL-707
+            'pkg:maven/org.antlr/antlr4-runtime@4.7.2?type=jar'               : 'BSD-3-Clause', // maps incorrectly because of https://github.com/CycloneDX/cyclonedx-core-java/issues/205
+            'pkg:maven/org.jline/jansi@3.30.9?type=jar'                       : 'BSD-3-Clause', // jline group resolved at 3.30.9 transitively via groovy-groovysh; main org.jline:jline pinned at 3.30.6 directly
+            'pkg:maven/org.jline/jline@3.30.6?type=jar'                       : 'BSD-3-Clause', // direct dependency declared at jline.version in dependencies.gradle
+            'pkg:maven/org.jline/jline-builtins@3.30.9?type=jar'              : 'BSD-3-Clause', // jline group resolved at 3.30.9 transitively via groovy-groovysh; main org.jline:jline pinned at 3.30.6 directly
+            'pkg:maven/org.jline/jline-console@3.30.9?type=jar'               : 'BSD-3-Clause', // jline group resolved at 3.30.9 transitively via groovy-groovysh; main org.jline:jline pinned at 3.30.6 directly
+            'pkg:maven/org.jline/jline-native@3.30.9?type=jar'                : 'BSD-3-Clause', // jline group resolved at 3.30.9 transitively via groovy-groovysh; main org.jline:jline pinned at 3.30.6 directly
+            'pkg:maven/org.jline/jline-reader@3.30.9?type=jar'                : 'BSD-3-Clause', // jline group resolved at 3.30.9 transitively via groovy-groovysh; main org.jline:jline pinned at 3.30.6 directly
+            'pkg:maven/org.jline/jline-style@3.30.9?type=jar'                 : 'BSD-3-Clause', // jline group resolved at 3.30.9 transitively via groovy-groovysh; main org.jline:jline pinned at 3.30.6 directly
+            'pkg:maven/org.jline/jline-terminal@3.30.9?type=jar'              : 'BSD-3-Clause', // jline group resolved at 3.30.9 transitively via groovy-groovysh; main org.jline:jline pinned at 3.30.6 directly
+            'pkg:maven/org.jline/jline-terminal-jansi@3.30.9?type=jar'        : 'BSD-3-Clause', // jline group resolved at 3.30.9 transitively via groovy-groovysh; main org.jline:jline pinned at 3.30.6 directly
+            'pkg:maven/org.jline/jline-terminal-jna@3.30.9?type=jar'          : 'BSD-3-Clause', // jline group resolved at 3.30.9 transitively via groovy-groovysh; main org.jline:jline pinned at 3.30.6 directly
+            'pkg:maven/org.jline/jline-terminal-jni@3.30.9?type=jar'          : 'BSD-3-Clause', // jline group resolved at 3.30.9 transitively via groovy-groovysh; main org.jline:jline pinned at 3.30.6 directly
             'pkg:maven/org.jruby/jzlib@1.1.5?type=jar'                        : 'BSD-3-Clause', // https://web.archive.org/web/20240822213507/http://www.jcraft.com/jzlib/LICENSE.txt shows it's a 3 clause
+            'pkg:maven/org.liquibase.ext/liquibase-hibernate5@4.27.0?type=jar': 'Apache-2.0', // maps incorrectly because of https://github.com/liquibase/liquibase/issues/2445 & the base pom does not define a license
     ]
 
     // we don't distribute these so these licenses are considered acceptable, but we still prefer ASF licenses.