The GitHub Actions job "CodeQL" on grails-core.git/feat/gradle-managed-version-overrides has failed. Run started by GitHub user jamesfredley (triggered by jamesfredley).
Head commit for run: d67ef2840517dc5e2954bd98e6cf3d22cb4d16a6 / James Fredley <[email protected]> Address review feedback: consolidate bom-property-overrides + def style + drop duplicates workaround Three review threads addressed: 1. jdaugherty: "this should be under the Gradle package to match our other plugins" The standalone grails-gradle-bom-property-overrides module is merged into grails-gradle-plugins, joining the 11 other plugins registered there. The plugin id (org.apache.grails.gradle.bom-property-overrides), extension name (bomPropertyOverrides) and implementation class (org.grails.gradle.plugin.bom.BomPropertyOverridesPlugin) are unchanged, so end-user usage is identical. - Move 3 main sources + 3 test sources + 4 test resources into grails-gradle/plugins/ - Drop the duplicate GradleSpecification.groovy in favour of the existing copy in grails-gradle/plugins/src/test/groovy/org/grails/gradle/plugin/core/ - Register bomPropertyOverrides as the 12th entry in the gradlePlugin{} block in plugins/build.gradle - Remove the now-self-referential implementation project(:grails-gradle-bom-property-overrides) dependency - Remove the include + projectDir mapping from grails-gradle/settings.gradle - Remove grails-gradle-bom-property-overrides from publishedProjects in grails-gradle/gradle/publish-root-config.gradle - Delete the now-empty grails-gradle/bom-property-overrides/ directory - Update class javadoc + doc reference to drop the "standalone" framing (the plugin is still BOM-agnostic and works for non-Grails projects; it just ships inside grails-gradle-plugins) 2. matrei: "Use def for local variables where the type can be inferred... This applies generally to all added Groovy code" Refactored BomManagedVersions, BomPropertyOverridesPlugin, BomManagedVersionsSpec and BomPropertyOverridesPluginSpec to use def for inferrable local variables. Public API method signatures and field declarations retain explicit types (the public contract is unchanged). The unused org.w3c.dom.NodeList import that the def refactor exposed is dropped. 3. jdaugherty: "What is causing the duplicate? We typically fix these so it's not needed" Confirmed by removing the tasks.withType(Copy) duplicatesStrategy = INCLUDE block from grails-gradle/plugins/build.gradle and running :grails-gradle-plugins:build with --rerun-tasks: all tasks pass green (compileGroovy, processResources, jar, sourcesJar, javadocJar, pluginUnderTestMetadata, test, codenarcMain, validatePlugins, cyclonedxDirectBom, check, build). The workaround was a copy-paste from older builds and is no longer needed; dropping it removes a stale escape hatch that could mask genuine duplicates in future. Verification: ./gradlew :grails-gradle-plugins:build -> BUILD SUCCESSFUL in 1m 13s -> 30 tests pass (including all 12 newly-relocated bom tests and the BomPlatformFunctionalSpec end-to-end test) -> codenarcMain clean (31 files scanned, 0 violations) -> validatePlugins clean Report URL: https://github.com/apache/grails-core/actions/runs/26253536297 With regards, GitHub Actions via GitBox
