jdaugherty commented on code in PR #15467:
URL: https://github.com/apache/grails-core/pull/15467#discussion_r3197897442
##########
grails-data-graphql/examples/spring-boot-app/build.gradle:
##########
@@ -30,7 +30,6 @@ buildscript {
apply plugin: 'groovy'
apply plugin: 'idea'
apply plugin: 'org.springframework.boot'
-apply plugin: 'io.spring.dependency-management'
Review Comment:
We should remove this change or merge up 7.2 to pickup the graphql change
##########
grails-gradle/bom-property-overrides/build.gradle:
##########
@@ -0,0 +1,81 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+plugins {
+ id 'groovy'
+ id 'java-gradle-plugin'
+ id 'org.apache.grails.buildsrc.properties'
+ id 'org.apache.grails.buildsrc.dependency-validator'
+ id 'org.apache.grails.buildsrc.compile'
+ id 'org.apache.grails.buildsrc.publish'
+ id 'org.apache.grails.buildsrc.sbom'
+ id 'org.apache.grails.gradle.grails-code-style'
+}
+
+version = projectVersion
+group = 'org.apache.grails'
Review Comment:
this should be under the Gradle package to match our other plugins
##########
grails-gradle/plugins/src/main/groovy/org/grails/gradle/plugin/core/GrailsGradlePlugin.groovy:
##########
@@ -470,6 +524,13 @@ ${importStatements}
return
}
+ // The Grails Gradle Plugin injects a regular platform(grails-bom)
into every
+ // declarable configuration via applyGrailsBom(). For Micronaut
projects the user
+ // must additionally declare an enforcedPlatform(grails-micronaut-bom)
- a different
Review Comment:
This is no longer true
##########
grails-gradle/bom-property-overrides/src/main/groovy/org/grails/gradle/plugin/bom/BomManagedVersions.groovy:
##########
@@ -0,0 +1,378 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+package org.grails.gradle.plugin.bom
+
+import groovy.transform.CompileStatic
+import org.gradle.api.Project
+import org.gradle.api.artifacts.Configuration
+import org.gradle.api.artifacts.DependencyResolveDetails
+import org.gradle.api.logging.Logger
+import org.gradle.api.logging.Logging
+import org.w3c.dom.Document
+import org.w3c.dom.Element
+import org.w3c.dom.NodeList
+
+import javax.xml.parsers.DocumentBuilderFactory
+
+/**
+ * Lightweight replacement for the Spring Dependency Management plugin's
+ * version property override feature.
+ *
+ * <p>Parses BOM POM files to build a mapping of Maven property names
+ * (e.g., {@code slf4j.version}) to the artifacts they control. At
+ * dependency resolution time, checks whether the user has overridden
+ * any of these properties via {@code ext['property.name']} in
+ * {@code build.gradle} or via {@code gradle.properties}, and applies
+ * those overrides using Gradle's {@code
ResolutionStrategy.eachDependency()}.</p>
+ *
+ * <p>Gradle's native {@code platform()} mechanism handles the base
+ * BOM import and default version management. This class only adds the
+ * one feature Gradle lacks: property-based version customization
+ * (see <a href="https://github.com/gradle/gradle/issues/9160";>Gradle
#9160</a>).</p>
+ *
+ * <p>This is the underlying utility used by the
+ * {@code org.apache.grails.gradle.bom-property-overrides} plugin. It is
+ * BOM-agnostic and can be used directly with any BOM that follows the
+ * Maven {@code <properties>} convention for managed versions.</p>
+ *
+ * @since 8.0
+ */
+@CompileStatic
+class BomManagedVersions {
+
+ private static final Logger LOG = Logging.getLogger(BomManagedVersions)
+ private static final int MAX_PROPERTY_INTERPOLATION_DEPTH = 10
+
+ private final Map<String, String> versionOverrides = new LinkedHashMap<>()
+
+ /**
+ * Resolves a BOM, parses its POM chain, and determines which managed
+ * dependency versions need to be overridden based on project properties.
+ *
+ * @param project the Gradle project (used for artifact resolution and
property lookup)
+ * @param bomCoordinates the BOM coordinates in {@code
group:artifact:version} format
+ * @return a BomManagedVersions instance containing any version overrides
to apply
+ */
+ static BomManagedVersions resolve(Project project, String bomCoordinates) {
+ return resolve(project, [bomCoordinates])
+ }
+
+ /**
+ * Resolves multiple BOMs, parses their POM chains, and determines which
+ * managed dependency versions need to be overridden based on project
+ * properties. Useful when a project applies several platforms (e.g., a
+ * Grails BOM plus a Micronaut BOM) and any of them may declare overridable
+ * properties.
+ *
+ * @param project the Gradle project (used for artifact resolution and
property lookup)
+ * @param bomCoordinatesList list of BOM coordinates in {@code
group:artifact:version} format
+ * @return a BomManagedVersions instance containing any version overrides
to apply
+ */
+ static BomManagedVersions resolve(Project project, Collection<String>
bomCoordinatesList) {
+ BomManagedVersions instance = new BomManagedVersions()
+
+ Map<String, String> bomProperties = new LinkedHashMap<>()
+ Map<String, List<String>> propertyToArtifacts = new LinkedHashMap<>()
+ Set<String> processed = new HashSet<>()
+
+ for (String bomCoordinates : bomCoordinatesList) {
+ String[] parts = bomCoordinates?.split(':')
+ if (parts == null || parts.length != 3) {
+ LOG.warn('Invalid BOM coordinates: {}', bomCoordinates)
+ continue
+ }
+ processBom(project, parts[0], parts[1], parts[2], bomProperties,
propertyToArtifacts, processed)
+ }
+
+ for (Map.Entry<String, List<String>> entry :
propertyToArtifacts.entrySet()) {
+ String propertyName = entry.key
+ if (project.hasProperty(propertyName)) {
+ String overrideVersion =
project.property(propertyName).toString()
+ String defaultVersion = bomProperties.get(propertyName)
+
+ if (overrideVersion != defaultVersion) {
+ for (String artifactKey : entry.value) {
+ instance.versionOverrides.put(artifactKey,
overrideVersion)
+ }
+ LOG.lifecycle(
+ 'BOM version override: {} = {} (BOM default: {})',
+ propertyName, overrideVersion, defaultVersion ?:
'unknown'
+ )
+ }
+ }
+ }
+
+ if (!instance.versionOverrides.isEmpty()) {
+ LOG.info('BOM property overrides: {} version override(s) will be
applied', instance.versionOverrides.size())
+ }
+
+ return instance
+ }
+
+ /**
+ * Applies version overrides to a Gradle configuration's resolution
strategy.
+ *
+ * @param configuration the configuration to apply overrides to
+ */
+ void applyTo(Configuration configuration) {
+ if (versionOverrides.isEmpty()) {
+ return
+ }
+
+ Map<String, String> overrides = this.versionOverrides
+ configuration.resolutionStrategy.eachDependency {
DependencyResolveDetails details ->
+ String key =
"${details.requested.group}:${details.requested.name}" as String
+ String override = overrides.get(key)
+ if (override != null) {
+ details.useVersion(override)
+ details.because('BOM version override via project property')
+ }
+ }
+ }
+
+ /**
+ * Returns whether any version overrides were detected.
+ */
+ boolean hasOverrides() {
+ return !versionOverrides.isEmpty()
+ }
+
+ /**
+ * Returns an unmodifiable view of the version overrides.
+ * Keys are {@code group:artifact}, values are the override version
strings.
+ */
+ Map<String, String> getOverrides() {
+ return Collections.unmodifiableMap(versionOverrides)
+ }
+
+ /**
+ * Parses a BOM POM file and extracts the property-to-artifact mapping.
+ * This method does not follow imported BOMs recursively - it only
processes
+ * the given file. Intended for testing and direct POM inspection.
+ *
+ * @param pomFile the BOM POM file to parse
+ * @param bomProperties output map to receive property name to default
value mappings
+ * @param propertyToArtifacts output map to receive property name to
artifact coordinate mappings
+ */
+ static void parseBomFile(File pomFile, Map<String, String> bomProperties,
Map<String, List<String>> propertyToArtifacts) {
+ Document doc = parseXml(pomFile)
+ if (doc == null) {
+ return
+ }
+ extractProperties(doc, bomProperties)
+
+ NodeList depMgmtNodes =
doc.getElementsByTagName('dependencyManagement')
+ if (depMgmtNodes.length == 0) {
+ return
+ }
+ Element depMgmt = (Element) depMgmtNodes.item(0)
+ NodeList dependenciesNodes =
depMgmt.getElementsByTagName('dependencies')
+ if (dependenciesNodes.length == 0) {
+ return
+ }
+ Element dependenciesElement = (Element) dependenciesNodes.item(0)
+ NodeList depNodes =
dependenciesElement.getElementsByTagName('dependency')
+
+ for (int i = 0; i < depNodes.length; i++) {
+ Element dep = (Element) depNodes.item(i)
+ String depGroupId = getChildText(dep, 'groupId')
+ String depArtifactId = getChildText(dep, 'artifactId')
+ String depVersion = getChildText(dep, 'version')
+
+ if (!depGroupId || !depArtifactId || !depVersion) {
+ continue
+ }
+
+ if (depVersion.contains('${')) {
+ String propertyName = extractPropertyName(depVersion)
+ if (propertyName) {
+ String artifactKey = "${depGroupId}:${depArtifactId}" as
String
+ propertyToArtifacts.computeIfAbsent(propertyName) { new
ArrayList<String>() }.add(artifactKey)
+ }
+ }
+ }
+ }
+
+ private static void processBom(
+ Project project, String group, String artifact, String version,
+ Map<String, String> bomProperties,
+ Map<String, List<String>> propertyToArtifacts,
+ Set<String> processed
+ ) {
+ String bomKey = "${group}:${artifact}:${version}" as String
+ if (!processed.add(bomKey)) {
+ return
+ }
+
+ File pomFile = resolvePomFile(project, group, artifact, version)
+ if (pomFile == null) {
+ return
+ }
+
+ Document doc = parseXml(pomFile)
+ if (doc == null) {
+ return
+ }
+
+ extractProperties(doc, bomProperties)
+ processManagedDependencies(doc, project, bomProperties,
propertyToArtifacts, processed)
+ }
+
+ private static File resolvePomFile(Project project, String group, String
artifact, String version) {
+ try {
+ Configuration detached =
project.configurations.detachedConfiguration(
+
project.dependencies.create("${group}:${artifact}:${version}@pom" as String)
+ )
+ detached.transitive = false
+ return detached.singleFile
+ }
+ catch (Exception e) {
+ LOG.info('Could not resolve BOM POM: {}:{}:{} - {}', group,
artifact, version, e.message)
+ return null
+ }
+ }
+
+ private static Document parseXml(File pomFile) {
+ try {
+ DocumentBuilderFactory factory =
DocumentBuilderFactory.newInstance()
+ factory.setNamespaceAware(false)
+ factory.setValidating(false)
+ factory.setXIncludeAware(false)
+
factory.setFeature('http://apache.org/xml/features/nonvalidating/load-external-dtd',
false)
+
factory.setFeature('http://xml.org/sax/features/external-general-entities',
false)
+
factory.setFeature('http://xml.org/sax/features/external-parameter-entities',
false)
+ return factory.newDocumentBuilder().parse(pomFile)
+ }
+ catch (Exception e) {
+ LOG.warn('Failed to parse BOM POM: {} - {}', pomFile.name,
e.message)
+ return null
+ }
+ }
+
+ private static void extractProperties(Document doc, Map<String, String>
bomProperties) {
+ NodeList propertiesNodes = doc.getElementsByTagName('properties')
+ if (propertiesNodes.length == 0) {
+ return
+ }
+
+ Element propertiesElement = (Element) propertiesNodes.item(0)
+ NodeList children = propertiesElement.childNodes
+ for (int i = 0; i < children.length; i++) {
+ if (children.item(i) instanceof Element) {
+ Element prop = (Element) children.item(i)
+ String name = prop.tagName
+ String value = prop.textContent?.trim()
+ if (name && value) {
+ bomProperties.put(name, value)
+ }
+ }
+ }
+ }
+
+ private static void processManagedDependencies(
+ Document doc, Project project,
+ Map<String, String> bomProperties,
+ Map<String, List<String>> propertyToArtifacts,
+ Set<String> processed
+ ) {
+ NodeList depMgmtNodes =
doc.getElementsByTagName('dependencyManagement')
+ if (depMgmtNodes.length == 0) {
+ return
+ }
+
+ Element depMgmt = (Element) depMgmtNodes.item(0)
+ NodeList dependenciesNodes =
depMgmt.getElementsByTagName('dependencies')
+ if (dependenciesNodes.length == 0) {
+ return
+ }
+
+ Element dependenciesElement = (Element) dependenciesNodes.item(0)
+ NodeList depNodes =
dependenciesElement.getElementsByTagName('dependency')
+
+ for (int i = 0; i < depNodes.length; i++) {
+ Element dep = (Element) depNodes.item(i)
+ String depGroupId = getChildText(dep, 'groupId')
+ String depArtifactId = getChildText(dep, 'artifactId')
+ String depVersion = getChildText(dep, 'version')
+ String depScope = getChildText(dep, 'scope')
+
+ if (!depGroupId || !depArtifactId) {
+ continue
+ }
+
+ if ('import' == depScope) {
+ String resolvedVersion = interpolateProperties(depVersion,
bomProperties)
+ if (resolvedVersion) {
+ processBom(project, depGroupId, depArtifactId,
resolvedVersion,
+ bomProperties, propertyToArtifacts, processed)
+ }
+ continue
+ }
+
+ if (depVersion && depVersion.contains('${')) {
+ String propertyName = extractPropertyName(depVersion)
+ if (propertyName) {
+ String artifactKey = "${depGroupId}:${depArtifactId}" as
String
+ propertyToArtifacts.computeIfAbsent(propertyName) { new
ArrayList<String>() }.add(artifactKey)
+ }
+ }
+ }
+ }
+
+ private static String extractPropertyName(String versionStr) {
+ if (versionStr == null) {
+ return null
+ }
+ int start = versionStr.indexOf('${')
+ int end = versionStr.indexOf('}', start)
+ if (start >= 0 && end > start) {
+ return versionStr.substring(start + 2, end)
+ }
+ return null
+ }
+
+ private static String interpolateProperties(String value, Map<String,
String> properties) {
+ if (value == null || !value.contains('${')) {
Review Comment:
Properties are often defined on the parent boms; I think this is going to be
a problem
##########
grails-gradle/bom-property-overrides/build.gradle:
##########
@@ -0,0 +1,81 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+plugins {
+ id 'groovy'
+ id 'java-gradle-plugin'
+ id 'org.apache.grails.buildsrc.properties'
+ id 'org.apache.grails.buildsrc.dependency-validator'
+ id 'org.apache.grails.buildsrc.compile'
+ id 'org.apache.grails.buildsrc.publish'
+ id 'org.apache.grails.buildsrc.sbom'
+ id 'org.apache.grails.gradle.grails-code-style'
+}
+
+version = projectVersion
+group = 'org.apache.grails'
+
+ext {
+ pomTitle = 'Grails BOM Property Overrides Gradle Plugin'
+ pomDescription = 'A standalone Gradle plugin that enables Maven-style
property-based version overrides for any Gradle platform() BOM. Reads the BOM
POM <properties> block and lets consumers override versions via
gradle.properties or ext[\'property.name\']. Reusable independently of Grails.'
+ pomMavenPublicationName = 'pluginMaven'
+}
+
+dependencies {
+ implementation platform(project(':grails-gradle-bom'))
+
+ // compile with the Groovy version provided by Gradle
+ // see: https://docs.gradle.org/current/userguide/compatibility.html#groovy
+ compileOnly 'org.apache.groovy:groovy'
+
+ // Testing - Gradle TestKit is auto-added by java-gradle-plugin
+ testImplementation('org.spockframework:spock-core') { transitive = false }
+ testImplementation 'org.apache.groovy:groovy-test-junit5'
+ testRuntimeOnly 'org.junit.jupiter:junit-jupiter-engine'
+}
+
+configurations {
+ testCompileClasspath.exclude group: 'org.apache.groovy', module: 'groovy'
+ testRuntimeClasspath.exclude group: 'org.apache.groovy', module: 'groovy'
+}
+
+gradlePlugin {
+ plugins {
+ bomPropertyOverrides {
+ displayName = 'Grails BOM Property Overrides Plugin'
+ description = 'Enables Maven-style property-based version
overrides for any Gradle platform() BOM. ' +
+ 'Apply this plugin and override versions via
gradle.properties or ext[\'property.name\']. ' +
+ 'Auto-detects declared platform() BOMs by default, or
accepts an explicit list via the ' +
+ 'bomPropertyOverrides extension.'
+ id = 'org.apache.grails.gradle.bom-property-overrides'
+ implementationClass =
'org.grails.gradle.plugin.bom.BomPropertyOverridesPlugin'
+ }
+ }
+}
+
+tasks.withType(Copy) {
+ configure {
+ duplicatesStrategy = DuplicatesStrategy.INCLUDE
Review Comment:
What is causing the duplicate? We typically fix these so it's not needed
##########
grails-test-examples/gsp-spring-boot/app/build.gradle:
##########
@@ -21,7 +21,6 @@ plugins {
id 'java'
id 'war'
id 'org.springframework.boot'
- id 'io.spring.dependency-management'
Review Comment:
should this stay for this app - isn't this supposed to be used with spring
boot only?
##########
grails-gradle/plugins/src/main/groovy/org/grails/gradle/plugin/core/GrailsGradlePlugin.groovy:
##########
@@ -360,19 +359,81 @@ ${importStatements}
protected void applyDefaultPlugins(Project project) {
applySpringBootPlugin(project)
- project.afterEvaluate {
- GrailsExtension ge = project.extensions.getByType(GrailsExtension)
- if (ge.springDependencyManagement) {
- Plugin dependencyManagementPlugin =
project.plugins.findPlugin(DependencyManagementPlugin)
- if (dependencyManagementPlugin == null) {
- project.plugins.apply(DependencyManagementPlugin)
- }
-
- DependencyManagementExtension dme =
project.extensions.findByType(DependencyManagementExtension)
+ applyGrailsBom(project)
+ }
- applyBomImport(dme, project)
+ /**
+ * Applies the Grails BOM as a Gradle platform and enables property-based
+ * version overrides via the standalone
+ * {@code org.apache.grails.gradle.bom-property-overrides} plugin.
+ *
+ * <p>This replaces the Spring Dependency Management plugin with two
+ * orthogonal pieces:</p>
+ * <ol>
+ * <li><strong>BOM import</strong>: {@code grails-bom} is added as a
+ * Gradle {@code platform()} dependency on every declarable
+ * configuration, mirroring the global behaviour Spring DM provided
+ * via {@code configurations.all() +
resolutionStrategy.eachDependency()}.</li>
+ * <li><strong>Property overrides</strong>: the BOM-agnostic
+ * {@link BomPropertyOverridesPlugin} reads the BOM's
+ * {@code <properties>} block and applies any project-level
+ * overrides via Gradle's
+ * {@code ResolutionStrategy.eachDependency()}.</li>
+ * </ol>
+ *
+ * <p>Usage: to override a version managed by the Grails or Spring Boot
BOM, set the
+ * corresponding property in {@code gradle.properties} or {@code
build.gradle}:</p>
+ * <pre>
+ * // gradle.properties
+ * slf4j.version=1.7.36
+ *
+ * // or build.gradle
+ * ext['slf4j.version'] = '1.7.36'
+ * </pre>
+ *
+ * @see BomPropertyOverridesPlugin
+ * @since 8.0
+ */
+ protected void applyGrailsBom(Project project) {
+ String grailsVersion = (project.findProperty('grailsVersion') ?:
BuildSettings.grailsVersion) as String
+ String bomCoordinates =
"org.apache.grails:grails-bom:${grailsVersion}" as String
+
+ // Ensure the developmentOnly configuration exists. Spring Boot's
plugin
+ // normally creates this, but using maybeCreate guarantees it is
available
+ // even if plugin ordering changes or Spring Boot is not applied.
Review Comment:
We still have to use spring boot plugin and we should always apple after it
using with plugin
##########
grails-gradle/bom-property-overrides/src/main/groovy/org/grails/gradle/plugin/bom/BomPropertyOverridesPlugin.groovy:
##########
@@ -0,0 +1,167 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+package org.grails.gradle.plugin.bom
+
+import groovy.transform.CompileStatic
+import org.gradle.api.Plugin
+import org.gradle.api.Project
+import org.gradle.api.artifacts.Configuration
+import org.gradle.api.artifacts.Dependency
+import org.gradle.api.artifacts.ModuleDependency
+import org.gradle.api.attributes.Category
+
+/**
+ * Standalone Gradle plugin that enables Maven-style property-based version
+ * overrides for {@code platform()} BOMs.
+ *
+ * <p>This is the BOM-agnostic, generically reusable extraction of the
+ * property-override mechanism that historically lived inside the Spring
+ * Dependency Management plugin. Apply it to any project that consumes a
+ * BOM published with version property references in its
+ * {@code <dependencyManagement>} block:</p>
+ *
+ * <pre>
+ * plugins {
+ * id 'org.apache.grails.gradle.bom-property-overrides'
+ * }
+ *
+ * dependencies {
+ * implementation platform('com.example:my-bom:1.0.0')
+ * }
+ *
+ * // gradle.properties or build.gradle
+ * ext['slf4j.version'] = '2.0.13'
+ * </pre>
+ *
+ * <h2>How it works</h2>
+ * <ol>
+ * <li>Auto-detects all {@code platform()} / {@code enforcedPlatform()}
+ * dependencies declared on the project's configurations (configurable
+ * via {@link BomPropertyOverridesExtension#autoDetect}).</li>
+ * <li>Resolves each BOM POM in a detached configuration, parses the
+ * {@code <properties>} block and the
+ * {@code <dependencyManagement>} entries, and recursively follows
+ * {@code <scope>import</scope>} BOMs.</li>
+ * <li>For every property the BOM declares, checks whether the project
+ * has a property with the same name (via {@code gradle.properties}
+ * or {@code ext['property.name']}). If so, applies the override at
+ * resolution time using
+ * {@link Configuration#getResolutionStrategy()}'s
+ * {@code eachDependency} hook.</li>
+ * </ol>
+ *
+ * <p>The plugin does <strong>not</strong> declare any platforms itself.
+ * Consumers (or other plugins like {@code grails-app}) remain responsible
+ * for declaring the {@code platform()} dependencies; this plugin only
+ * adds the property-override layer on top.</p>
+ *
+ * @since 8.0
+ * @see BomManagedVersions
+ * @see BomPropertyOverridesExtension
+ */
+@CompileStatic
+class BomPropertyOverridesPlugin implements Plugin<Project> {
+
+ /**
+ * The plugin id, exposed as a constant for programmatic application
+ * (e.g. {@code
project.plugins.apply(BomPropertyOverridesPlugin.PLUGIN_ID)}).
+ */
+ static final String PLUGIN_ID =
'org.apache.grails.gradle.bom-property-overrides'
+
+ @Override
+ void apply(Project project) {
+ BomPropertyOverridesExtension extension = project.extensions.create(
+ BomPropertyOverridesExtension.EXTENSION_NAME,
+ BomPropertyOverridesExtension,
+ project.objects
+ )
+
+ project.afterEvaluate {
Review Comment:
Should we really use after eval?
##########
grails-gradle/bom-property-overrides/src/main/groovy/org/grails/gradle/plugin/bom/BomManagedVersions.groovy:
##########
@@ -0,0 +1,378 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+package org.grails.gradle.plugin.bom
+
+import groovy.transform.CompileStatic
+import org.gradle.api.Project
+import org.gradle.api.artifacts.Configuration
+import org.gradle.api.artifacts.DependencyResolveDetails
+import org.gradle.api.logging.Logger
+import org.gradle.api.logging.Logging
+import org.w3c.dom.Document
+import org.w3c.dom.Element
+import org.w3c.dom.NodeList
+
+import javax.xml.parsers.DocumentBuilderFactory
+
+/**
+ * Lightweight replacement for the Spring Dependency Management plugin's
+ * version property override feature.
+ *
+ * <p>Parses BOM POM files to build a mapping of Maven property names
+ * (e.g., {@code slf4j.version}) to the artifacts they control. At
+ * dependency resolution time, checks whether the user has overridden
+ * any of these properties via {@code ext['property.name']} in
+ * {@code build.gradle} or via {@code gradle.properties}, and applies
+ * those overrides using Gradle's {@code
ResolutionStrategy.eachDependency()}.</p>
+ *
+ * <p>Gradle's native {@code platform()} mechanism handles the base
+ * BOM import and default version management. This class only adds the
+ * one feature Gradle lacks: property-based version customization
+ * (see <a href="https://github.com/gradle/gradle/issues/9160";>Gradle
#9160</a>).</p>
+ *
+ * <p>This is the underlying utility used by the
+ * {@code org.apache.grails.gradle.bom-property-overrides} plugin. It is
+ * BOM-agnostic and can be used directly with any BOM that follows the
+ * Maven {@code <properties>} convention for managed versions.</p>
+ *
+ * @since 8.0
+ */
+@CompileStatic
+class BomManagedVersions {
+
+ private static final Logger LOG = Logging.getLogger(BomManagedVersions)
+ private static final int MAX_PROPERTY_INTERPOLATION_DEPTH = 10
+
+ private final Map<String, String> versionOverrides = new LinkedHashMap<>()
+
+ /**
+ * Resolves a BOM, parses its POM chain, and determines which managed
+ * dependency versions need to be overridden based on project properties.
+ *
+ * @param project the Gradle project (used for artifact resolution and
property lookup)
+ * @param bomCoordinates the BOM coordinates in {@code
group:artifact:version} format
+ * @return a BomManagedVersions instance containing any version overrides
to apply
+ */
+ static BomManagedVersions resolve(Project project, String bomCoordinates) {
+ return resolve(project, [bomCoordinates])
+ }
+
+ /**
+ * Resolves multiple BOMs, parses their POM chains, and determines which
+ * managed dependency versions need to be overridden based on project
+ * properties. Useful when a project applies several platforms (e.g., a
+ * Grails BOM plus a Micronaut BOM) and any of them may declare overridable
+ * properties.
+ *
+ * @param project the Gradle project (used for artifact resolution and
property lookup)
+ * @param bomCoordinatesList list of BOM coordinates in {@code
group:artifact:version} format
+ * @return a BomManagedVersions instance containing any version overrides
to apply
+ */
+ static BomManagedVersions resolve(Project project, Collection<String>
bomCoordinatesList) {
+ BomManagedVersions instance = new BomManagedVersions()
+
+ Map<String, String> bomProperties = new LinkedHashMap<>()
+ Map<String, List<String>> propertyToArtifacts = new LinkedHashMap<>()
+ Set<String> processed = new HashSet<>()
+
+ for (String bomCoordinates : bomCoordinatesList) {
+ String[] parts = bomCoordinates?.split(':')
+ if (parts == null || parts.length != 3) {
+ LOG.warn('Invalid BOM coordinates: {}', bomCoordinates)
+ continue
+ }
+ processBom(project, parts[0], parts[1], parts[2], bomProperties,
propertyToArtifacts, processed)
+ }
+
+ for (Map.Entry<String, List<String>> entry :
propertyToArtifacts.entrySet()) {
+ String propertyName = entry.key
+ if (project.hasProperty(propertyName)) {
+ String overrideVersion =
project.property(propertyName).toString()
+ String defaultVersion = bomProperties.get(propertyName)
+
+ if (overrideVersion != defaultVersion) {
+ for (String artifactKey : entry.value) {
+ instance.versionOverrides.put(artifactKey,
overrideVersion)
+ }
+ LOG.lifecycle(
+ 'BOM version override: {} = {} (BOM default: {})',
+ propertyName, overrideVersion, defaultVersion ?:
'unknown'
+ )
+ }
+ }
+ }
+
+ if (!instance.versionOverrides.isEmpty()) {
+ LOG.info('BOM property overrides: {} version override(s) will be
applied', instance.versionOverrides.size())
+ }
+
+ return instance
+ }
+
+ /**
+ * Applies version overrides to a Gradle configuration's resolution
strategy.
+ *
+ * @param configuration the configuration to apply overrides to
+ */
+ void applyTo(Configuration configuration) {
+ if (versionOverrides.isEmpty()) {
+ return
+ }
+
+ Map<String, String> overrides = this.versionOverrides
+ configuration.resolutionStrategy.eachDependency {
DependencyResolveDetails details ->
+ String key =
"${details.requested.group}:${details.requested.name}" as String
+ String override = overrides.get(key)
+ if (override != null) {
+ details.useVersion(override)
+ details.because('BOM version override via project property')
+ }
+ }
+ }
+
+ /**
+ * Returns whether any version overrides were detected.
+ */
+ boolean hasOverrides() {
+ return !versionOverrides.isEmpty()
+ }
+
+ /**
+ * Returns an unmodifiable view of the version overrides.
+ * Keys are {@code group:artifact}, values are the override version
strings.
+ */
+ Map<String, String> getOverrides() {
+ return Collections.unmodifiableMap(versionOverrides)
+ }
+
+ /**
+ * Parses a BOM POM file and extracts the property-to-artifact mapping.
Review Comment:
Don't we have to recurse to make this useful? We don't override every
dependency in spring boot bom...
##########
grails-gradle/bom-property-overrides/build.gradle:
##########
@@ -0,0 +1,81 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+plugins {
+ id 'groovy'
+ id 'java-gradle-plugin'
+ id 'org.apache.grails.buildsrc.properties'
+ id 'org.apache.grails.buildsrc.dependency-validator'
+ id 'org.apache.grails.buildsrc.compile'
+ id 'org.apache.grails.buildsrc.publish'
+ id 'org.apache.grails.buildsrc.sbom'
+ id 'org.apache.grails.gradle.grails-code-style'
+}
+
+version = projectVersion
+group = 'org.apache.grails'
+
+ext {
+ pomTitle = 'Grails BOM Property Overrides Gradle Plugin'
+ pomDescription = 'A standalone Gradle plugin that enables Maven-style
property-based version overrides for any Gradle platform() BOM. Reads the BOM
POM <properties> block and lets consumers override versions via
gradle.properties or ext[\'property.name\']. Reusable independently of Grails.'
+ pomMavenPublicationName = 'pluginMaven'
+}
+
+dependencies {
+ implementation platform(project(':grails-gradle-bom'))
+
+ // compile with the Groovy version provided by Gradle
+ // see: https://docs.gradle.org/current/userguide/compatibility.html#groovy
+ compileOnly 'org.apache.groovy:groovy'
+
+ // Testing - Gradle TestKit is auto-added by java-gradle-plugin
+ testImplementation('org.spockframework:spock-core') { transitive = false }
+ testImplementation 'org.apache.groovy:groovy-test-junit5'
+ testRuntimeOnly 'org.junit.jupiter:junit-jupiter-engine'
+}
+
+configurations {
+ testCompileClasspath.exclude group: 'org.apache.groovy', module: 'groovy'
Review Comment:
Why are we excluding these anyhow?
##########
grails-gradle/plugins/src/main/groovy/org/grails/gradle/plugin/core/GrailsGradlePlugin.groovy:
##########
@@ -360,19 +359,81 @@ ${importStatements}
protected void applyDefaultPlugins(Project project) {
applySpringBootPlugin(project)
- project.afterEvaluate {
- GrailsExtension ge = project.extensions.getByType(GrailsExtension)
- if (ge.springDependencyManagement) {
- Plugin dependencyManagementPlugin =
project.plugins.findPlugin(DependencyManagementPlugin)
- if (dependencyManagementPlugin == null) {
- project.plugins.apply(DependencyManagementPlugin)
- }
-
- DependencyManagementExtension dme =
project.extensions.findByType(DependencyManagementExtension)
+ applyGrailsBom(project)
+ }
- applyBomImport(dme, project)
+ /**
+ * Applies the Grails BOM as a Gradle platform and enables property-based
+ * version overrides via the standalone
+ * {@code org.apache.grails.gradle.bom-property-overrides} plugin.
+ *
+ * <p>This replaces the Spring Dependency Management plugin with two
+ * orthogonal pieces:</p>
+ * <ol>
+ * <li><strong>BOM import</strong>: {@code grails-bom} is added as a
+ * Gradle {@code platform()} dependency on every declarable
+ * configuration, mirroring the global behaviour Spring DM provided
+ * via {@code configurations.all() +
resolutionStrategy.eachDependency()}.</li>
+ * <li><strong>Property overrides</strong>: the BOM-agnostic
+ * {@link BomPropertyOverridesPlugin} reads the BOM's
+ * {@code <properties>} block and applies any project-level
+ * overrides via Gradle's
+ * {@code ResolutionStrategy.eachDependency()}.</li>
+ * </ol>
+ *
+ * <p>Usage: to override a version managed by the Grails or Spring Boot
BOM, set the
+ * corresponding property in {@code gradle.properties} or {@code
build.gradle}:</p>
+ * <pre>
+ * // gradle.properties
+ * slf4j.version=1.7.36
+ *
+ * // or build.gradle
+ * ext['slf4j.version'] = '1.7.36'
+ * </pre>
+ *
+ * @see BomPropertyOverridesPlugin
+ * @since 8.0
+ */
+ protected void applyGrailsBom(Project project) {
+ String grailsVersion = (project.findProperty('grailsVersion') ?:
BuildSettings.grailsVersion) as String
+ String bomCoordinates =
"org.apache.grails:grails-bom:${grailsVersion}" as String
+
+ // Ensure the developmentOnly configuration exists. Spring Boot's
plugin
+ // normally creates this, but using maybeCreate guarantees it is
available
+ // even if plugin ordering changes or Spring Boot is not applied.
+ project.configurations.maybeCreate('developmentOnly')
+
+ // Apply the BOM platform to all declarable project configurations,
matching
+ // the behavior of the Spring Dependency Management plugin which
applied version
+ // constraints globally via configurations.all() +
resolutionStrategy.eachDependency().
+ // Non-declarable configurations (e.g. apiElements, runtimeElements)
inherit
+ // constraints through their parent configurations.
Tool/annotation-processor
+ // configurations are excluded because they hold independent
classpaths that
+ // already use their own platforms (e.g. Micronaut's annotation
processors
+ // import io.micronaut.platform:micronaut-platform). Adding grails-bom
as a
+ // second non-enforced platform on those configurations causes version
conflict
+ // resolution to upgrade transitives and break the tools/processors -
unlike
+ // resolutionStrategy hooks, platform() constraints participate in
version
+ // conflict resolution.
+ project.configurations.configureEach { Configuration conf ->
Review Comment:
We should have this plugin apply be configurable - default opt in
##########
grails-gradle/bom-property-overrides/src/main/groovy/org/grails/gradle/plugin/bom/BomManagedVersions.groovy:
##########
@@ -0,0 +1,378 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+package org.grails.gradle.plugin.bom
+
+import groovy.transform.CompileStatic
+import org.gradle.api.Project
+import org.gradle.api.artifacts.Configuration
+import org.gradle.api.artifacts.DependencyResolveDetails
+import org.gradle.api.logging.Logger
+import org.gradle.api.logging.Logging
+import org.w3c.dom.Document
+import org.w3c.dom.Element
+import org.w3c.dom.NodeList
+
+import javax.xml.parsers.DocumentBuilderFactory
+
+/**
+ * Lightweight replacement for the Spring Dependency Management plugin's
+ * version property override feature.
+ *
+ * <p>Parses BOM POM files to build a mapping of Maven property names
+ * (e.g., {@code slf4j.version}) to the artifacts they control. At
+ * dependency resolution time, checks whether the user has overridden
+ * any of these properties via {@code ext['property.name']} in
+ * {@code build.gradle} or via {@code gradle.properties}, and applies
+ * those overrides using Gradle's {@code
ResolutionStrategy.eachDependency()}.</p>
+ *
+ * <p>Gradle's native {@code platform()} mechanism handles the base
+ * BOM import and default version management. This class only adds the
+ * one feature Gradle lacks: property-based version customization
+ * (see <a href="https://github.com/gradle/gradle/issues/9160";>Gradle
#9160</a>).</p>
+ *
+ * <p>This is the underlying utility used by the
+ * {@code org.apache.grails.gradle.bom-property-overrides} plugin. It is
+ * BOM-agnostic and can be used directly with any BOM that follows the
+ * Maven {@code <properties>} convention for managed versions.</p>
+ *
+ * @since 8.0
+ */
+@CompileStatic
+class BomManagedVersions {
+
+ private static final Logger LOG = Logging.getLogger(BomManagedVersions)
+ private static final int MAX_PROPERTY_INTERPOLATION_DEPTH = 10
+
+ private final Map<String, String> versionOverrides = new LinkedHashMap<>()
+
+ /**
+ * Resolves a BOM, parses its POM chain, and determines which managed
+ * dependency versions need to be overridden based on project properties.
+ *
+ * @param project the Gradle project (used for artifact resolution and
property lookup)
+ * @param bomCoordinates the BOM coordinates in {@code
group:artifact:version} format
+ * @return a BomManagedVersions instance containing any version overrides
to apply
+ */
+ static BomManagedVersions resolve(Project project, String bomCoordinates) {
+ return resolve(project, [bomCoordinates])
+ }
+
+ /**
+ * Resolves multiple BOMs, parses their POM chains, and determines which
+ * managed dependency versions need to be overridden based on project
+ * properties. Useful when a project applies several platforms (e.g., a
+ * Grails BOM plus a Micronaut BOM) and any of them may declare overridable
+ * properties.
+ *
+ * @param project the Gradle project (used for artifact resolution and
property lookup)
+ * @param bomCoordinatesList list of BOM coordinates in {@code
group:artifact:version} format
+ * @return a BomManagedVersions instance containing any version overrides
to apply
+ */
+ static BomManagedVersions resolve(Project project, Collection<String>
bomCoordinatesList) {
+ BomManagedVersions instance = new BomManagedVersions()
+
+ Map<String, String> bomProperties = new LinkedHashMap<>()
+ Map<String, List<String>> propertyToArtifacts = new LinkedHashMap<>()
+ Set<String> processed = new HashSet<>()
+
+ for (String bomCoordinates : bomCoordinatesList) {
+ String[] parts = bomCoordinates?.split(':')
+ if (parts == null || parts.length != 3) {
+ LOG.warn('Invalid BOM coordinates: {}', bomCoordinates)
+ continue
+ }
+ processBom(project, parts[0], parts[1], parts[2], bomProperties,
propertyToArtifacts, processed)
+ }
+
+ for (Map.Entry<String, List<String>> entry :
propertyToArtifacts.entrySet()) {
+ String propertyName = entry.key
+ if (project.hasProperty(propertyName)) {
+ String overrideVersion =
project.property(propertyName).toString()
+ String defaultVersion = bomProperties.get(propertyName)
+
+ if (overrideVersion != defaultVersion) {
+ for (String artifactKey : entry.value) {
+ instance.versionOverrides.put(artifactKey,
overrideVersion)
+ }
+ LOG.lifecycle(
+ 'BOM version override: {} = {} (BOM default: {})',
+ propertyName, overrideVersion, defaultVersion ?:
'unknown'
+ )
+ }
+ }
+ }
+
+ if (!instance.versionOverrides.isEmpty()) {
+ LOG.info('BOM property overrides: {} version override(s) will be
applied', instance.versionOverrides.size())
+ }
+
+ return instance
+ }
+
+ /**
+ * Applies version overrides to a Gradle configuration's resolution
strategy.
+ *
+ * @param configuration the configuration to apply overrides to
+ */
+ void applyTo(Configuration configuration) {
+ if (versionOverrides.isEmpty()) {
+ return
+ }
+
+ Map<String, String> overrides = this.versionOverrides
+ configuration.resolutionStrategy.eachDependency {
DependencyResolveDetails details ->
+ String key =
"${details.requested.group}:${details.requested.name}" as String
+ String override = overrides.get(key)
+ if (override != null) {
+ details.useVersion(override)
+ details.because('BOM version override via project property')
+ }
+ }
+ }
+
+ /**
+ * Returns whether any version overrides were detected.
+ */
+ boolean hasOverrides() {
+ return !versionOverrides.isEmpty()
+ }
+
+ /**
+ * Returns an unmodifiable view of the version overrides.
+ * Keys are {@code group:artifact}, values are the override version
strings.
+ */
+ Map<String, String> getOverrides() {
+ return Collections.unmodifiableMap(versionOverrides)
+ }
+
+ /**
+ * Parses a BOM POM file and extracts the property-to-artifact mapping.
+ * This method does not follow imported BOMs recursively - it only
processes
+ * the given file. Intended for testing and direct POM inspection.
+ *
+ * @param pomFile the BOM POM file to parse
+ * @param bomProperties output map to receive property name to default
value mappings
+ * @param propertyToArtifacts output map to receive property name to
artifact coordinate mappings
+ */
+ static void parseBomFile(File pomFile, Map<String, String> bomProperties,
Map<String, List<String>> propertyToArtifacts) {
+ Document doc = parseXml(pomFile)
+ if (doc == null) {
+ return
+ }
+ extractProperties(doc, bomProperties)
+
+ NodeList depMgmtNodes =
doc.getElementsByTagName('dependencyManagement')
+ if (depMgmtNodes.length == 0) {
+ return
+ }
+ Element depMgmt = (Element) depMgmtNodes.item(0)
+ NodeList dependenciesNodes =
depMgmt.getElementsByTagName('dependencies')
+ if (dependenciesNodes.length == 0) {
+ return
+ }
+ Element dependenciesElement = (Element) dependenciesNodes.item(0)
+ NodeList depNodes =
dependenciesElement.getElementsByTagName('dependency')
+
+ for (int i = 0; i < depNodes.length; i++) {
+ Element dep = (Element) depNodes.item(i)
+ String depGroupId = getChildText(dep, 'groupId')
+ String depArtifactId = getChildText(dep, 'artifactId')
+ String depVersion = getChildText(dep, 'version')
+
+ if (!depGroupId || !depArtifactId || !depVersion) {
+ continue
+ }
+
+ if (depVersion.contains('${')) {
+ String propertyName = extractPropertyName(depVersion)
+ if (propertyName) {
+ String artifactKey = "${depGroupId}:${depArtifactId}" as
String
+ propertyToArtifacts.computeIfAbsent(propertyName) { new
ArrayList<String>() }.add(artifactKey)
+ }
+ }
+ }
+ }
+
+ private static void processBom(
+ Project project, String group, String artifact, String version,
+ Map<String, String> bomProperties,
+ Map<String, List<String>> propertyToArtifacts,
+ Set<String> processed
+ ) {
+ String bomKey = "${group}:${artifact}:${version}" as String
+ if (!processed.add(bomKey)) {
+ return
+ }
+
+ File pomFile = resolvePomFile(project, group, artifact, version)
+ if (pomFile == null) {
+ return
+ }
+
+ Document doc = parseXml(pomFile)
+ if (doc == null) {
+ return
+ }
+
+ extractProperties(doc, bomProperties)
+ processManagedDependencies(doc, project, bomProperties,
propertyToArtifacts, processed)
+ }
+
+ private static File resolvePomFile(Project project, String group, String
artifact, String version) {
+ try {
+ Configuration detached =
project.configurations.detachedConfiguration(
+
project.dependencies.create("${group}:${artifact}:${version}@pom" as String)
+ )
+ detached.transitive = false
+ return detached.singleFile
+ }
+ catch (Exception e) {
+ LOG.info('Could not resolve BOM POM: {}:{}:{} - {}', group,
artifact, version, e.message)
+ return null
+ }
+ }
+
+ private static Document parseXml(File pomFile) {
+ try {
Review Comment:
why not just use the maven libraries instead?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
