Re: [PR] Step 1 (PR-G): Add grails-code-analysis convention plugin + violation aggregation [grails-core]

[via GitHub]

matrei commented on code in PR #15686:
URL: https://github.com/apache/grails-core/pull/15686#discussion_r3330835315


##########
build-logic/plugins/src/main/groovy/org/apache/grails/buildsrc/GradleUtils.groovy:
##########
@@ -37,6 +38,12 @@ class GradleUtils {
         asfFile.exists() ? currentDirectory : 
findAsfRootDir(currentDirectory.dir('../'))
     }
 
+    static Provider<Boolean> booleanProvider(Project project, String name, 
boolean defaultValue = false) {
+        project.providers.gradleProperty(name)
+                .map { Boolean.parseBoolean(it as String) }

Review Comment:
   Should we use: `it.trim().toBoolean()`?



##########
build-logic/plugins/src/main/groovy/org/apache/grails/buildsrc/GrailsCodeAnalysisExtension.groovy:
##########
@@ -0,0 +1,53 @@
+/*
+ *  Licensed to the Apache Software Foundation (ASF) under one
+ *  or more contributor license agreements.  See the NOTICE file
+ *  distributed with this work for additional information
+ *  regarding copyright ownership.  The ASF licenses this file
+ *  to you under the Apache License, Version 2.0 (the
+ *  "License"); you may not use this file except in compliance
+ *  with the License.  You may obtain a copy of the License at
+ *
+ *    https://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing,
+ *  software distributed under the License is distributed on an
+ *  "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ *  KIND, either express or implied.  See the License for the
+ *  specific language governing permissions and limitations
+ *  under the License.
+ */
+package org.apache.grails.buildsrc
+
+import javax.inject.Inject
+
+import groovy.transform.CompileStatic
+
+import org.gradle.api.Project
+import org.gradle.api.file.DirectoryProperty
+import org.gradle.api.model.ObjectFactory
+
+@CompileStatic
+class GrailsCodeAnalysisExtension {
+
+    /**
+     * Defaults to project.rootProject.buildDir/codeanalysis/pmd.
+     * Directory for PMD configuration files (e.g. pmd.xml).
+     */
+    final DirectoryProperty pmdDirectory
+
+    /**
+     * Defaults to rootProject.buildDir/reports/codeanalysis.
+     * PMD and SpotBugs XML reports will be written here.
+     */
+    final DirectoryProperty reportsDirectory
+
+    @Inject
+    GrailsCodeAnalysisExtension(ObjectFactory objects, Project project) {
+        pmdDirectory = objects.directoryProperty().convention(
+                
project.rootProject.layout.buildDirectory.dir('codeanalysis/pmd')

Review Comment:
   Could we use directory name `code-analysis`?



##########
build-logic/plugins/src/main/groovy/org/apache/grails/buildsrc/GrailsCodeAnalysisExtension.groovy:
##########
@@ -0,0 +1,53 @@
+/*
+ *  Licensed to the Apache Software Foundation (ASF) under one
+ *  or more contributor license agreements.  See the NOTICE file
+ *  distributed with this work for additional information
+ *  regarding copyright ownership.  The ASF licenses this file
+ *  to you under the Apache License, Version 2.0 (the
+ *  "License"); you may not use this file except in compliance
+ *  with the License.  You may obtain a copy of the License at
+ *
+ *    https://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing,
+ *  software distributed under the License is distributed on an
+ *  "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ *  KIND, either express or implied.  See the License for the
+ *  specific language governing permissions and limitations
+ *  under the License.
+ */
+package org.apache.grails.buildsrc
+
+import javax.inject.Inject
+
+import groovy.transform.CompileStatic
+
+import org.gradle.api.Project
+import org.gradle.api.file.DirectoryProperty
+import org.gradle.api.model.ObjectFactory
+
+@CompileStatic
+class GrailsCodeAnalysisExtension {
+
+    /**
+     * Defaults to project.rootProject.buildDir/codeanalysis/pmd.
+     * Directory for PMD configuration files (e.g. pmd.xml).
+     */
+    final DirectoryProperty pmdDirectory
+
+    /**
+     * Defaults to rootProject.buildDir/reports/codeanalysis.

Review Comment:
   Should this be `project.rootProject`, like the one above, or can we remove 
the `project.` from both javadoc snippets?



##########
build-logic/plugins/src/main/groovy/org/apache/grails/buildsrc/GrailsCodeAnalysisExtension.groovy:
##########
@@ -0,0 +1,53 @@
+/*
+ *  Licensed to the Apache Software Foundation (ASF) under one
+ *  or more contributor license agreements.  See the NOTICE file
+ *  distributed with this work for additional information
+ *  regarding copyright ownership.  The ASF licenses this file
+ *  to you under the Apache License, Version 2.0 (the
+ *  "License"); you may not use this file except in compliance
+ *  with the License.  You may obtain a copy of the License at
+ *
+ *    https://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing,
+ *  software distributed under the License is distributed on an
+ *  "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ *  KIND, either express or implied.  See the License for the
+ *  specific language governing permissions and limitations
+ *  under the License.
+ */
+package org.apache.grails.buildsrc
+
+import javax.inject.Inject
+
+import groovy.transform.CompileStatic
+
+import org.gradle.api.Project
+import org.gradle.api.file.DirectoryProperty
+import org.gradle.api.model.ObjectFactory
+
+@CompileStatic
+class GrailsCodeAnalysisExtension {
+
+    /**
+     * Defaults to project.rootProject.buildDir/codeanalysis/pmd.
+     * Directory for PMD configuration files (e.g. pmd.xml).
+     */
+    final DirectoryProperty pmdDirectory
+
+    /**
+     * Defaults to rootProject.buildDir/reports/codeanalysis.
+     * PMD and SpotBugs XML reports will be written here.
+     */
+    final DirectoryProperty reportsDirectory
+
+    @Inject
+    GrailsCodeAnalysisExtension(ObjectFactory objects, Project project) {
+        pmdDirectory = objects.directoryProperty().convention(
+                
project.rootProject.layout.buildDirectory.dir('codeanalysis/pmd')
+        )
+        reportsDirectory = objects.directoryProperty().convention(
+                
project.rootProject.layout.buildDirectory.dir('reports/codeanalysis')

Review Comment:
   `code-analysis`?



##########
build-logic/plugins/src/main/groovy/org/apache/grails/buildsrc/GrailsCodeAnalysisPlugin.groovy:
##########
@@ -0,0 +1,183 @@
+/*
+ *  Licensed to the Apache Software Foundation (ASF) under one
+ *  or more contributor license agreements.  See the NOTICE file
+ *  distributed with this work for additional information
+ *  regarding copyright ownership.  The ASF licenses this file
+ *  to you under the Apache License, Version 2.0 (the
+ *  "License"); you may not use this file except in compliance
+ *  with the License.  You may obtain a copy of the License at
+ *
+ *    https://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing,
+ *  software distributed under the License is distributed on an
+ *  "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ *  KIND, either express or implied.  See the License for the
+ *  specific language governing permissions and limitations
+ *  under the License.
+ */
+package org.apache.grails.buildsrc
+
+import java.nio.file.Files
+import java.nio.file.Path
+
+import groovy.transform.CompileStatic
+
+import org.gradle.api.NamedDomainObjectContainer
+import org.gradle.api.Plugin
+import org.gradle.api.Project
+import org.gradle.api.plugins.quality.Pmd
+import org.gradle.api.plugins.quality.PmdExtension
+import org.gradle.api.plugins.quality.PmdPlugin
+import org.gradle.api.provider.Provider
+
+import com.github.spotbugs.snom.Confidence
+import com.github.spotbugs.snom.Effort
+import com.github.spotbugs.snom.SpotBugsExtension
+import com.github.spotbugs.snom.SpotBugsPlugin
+import com.github.spotbugs.snom.SpotBugsReport
+import com.github.spotbugs.snom.SpotBugsTask
+
+/**
+ * Convention plugin for Grails byte code analysis (PMD and SpotBugs).
+ * Both tools are opt-in; enable via Gradle properties.
+ */
+@CompileStatic
+class GrailsCodeAnalysisPlugin implements Plugin<Project> {
+
+    static String PMD_DIR_PROPERTY = 'grails.codeanalysis.dir.pmd'
+    static String PMD_ENABLED_PROPERTY = 'grails.codeanalysis.enabled.pmd'
+    static String PMD_CONFIG_FILE_NAME = 'pmd.xml'
+
+    static String SPOTBUGS_ENABLED_PROPERTY = 
'grails.codeanalysis.enabled.spotbugs'
+
+    static String IGNORE_FAILURES_PROPERTY = 
'grails.codeanalysis.ignoreFailures'
+    static String TEST_ANALYSIS_PROPERTY = 'grails.codeanalysis.enabled.tests'
+
+    static String BASE_RESOURCE_PATH = 
'/META-INF/org.apache.grails.buildsrc.grails-code-analysis'
+
+    @Override
+    void apply(Project project) {
+        initExtension(project)
+        configurePmd(project)
+        configureSpotbugs(project)
+
+        // withType returns a live empty collection when the tool is not 
enabled,
+        // so these dependsOn calls are safe regardless of whether 
PMD/SpotBugs are active
+        project.tasks.register('codeAnalysis') { task ->
+            task.group = 'verification'
+            task.description = 'Runs code analysis checks (PMD, SpotBugs)'
+            task.dependsOn(project.tasks.withType(Pmd))
+            task.dependsOn(project.tasks.withType(SpotBugsTask))
+        }
+    }
+
+    private static void initExtension(Project project) {
+        def gca = project.extensions.create('grailsCodeAnalysis', 
GrailsCodeAnalysisExtension)
+
+        gca.pmdDirectory.set(project.provider {
+            def directory = project.hasProperty(PMD_DIR_PROPERTY) ?
+                    
project.rootProject.layout.projectDirectory.dir(project.property(PMD_DIR_PROPERTY)
 as String) :
+                    
project.rootProject.layout.buildDirectory.get().dir('codeanalysis').dir('pmd')
+
+            def toCreate = directory.asFile.toPath()
+            Files.createDirectories(toCreate)
+
+            createOrLoad(
+                    toCreate.resolve(PMD_CONFIG_FILE_NAME),
+                    "${BASE_RESOURCE_PATH}/pmd/${PMD_CONFIG_FILE_NAME}",
+                    project
+            )
+
+            directory
+        })
+    }
+
+    private static void createOrLoad(Path expectedPath, String 
defaultResource, Project project) {
+        boolean defaultPath = 
expectedPath.startsWith(project.rootProject.buildDir.toPath())

Review Comment:
   `buildDir` deprecated?



##########
build-logic/plugins/src/main/groovy/org/apache/grails/buildsrc/GrailsCodeAnalysisPlugin.groovy:
##########
@@ -0,0 +1,183 @@
+/*
+ *  Licensed to the Apache Software Foundation (ASF) under one
+ *  or more contributor license agreements.  See the NOTICE file
+ *  distributed with this work for additional information
+ *  regarding copyright ownership.  The ASF licenses this file
+ *  to you under the Apache License, Version 2.0 (the
+ *  "License"); you may not use this file except in compliance
+ *  with the License.  You may obtain a copy of the License at
+ *
+ *    https://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing,
+ *  software distributed under the License is distributed on an
+ *  "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ *  KIND, either express or implied.  See the License for the
+ *  specific language governing permissions and limitations
+ *  under the License.
+ */
+package org.apache.grails.buildsrc
+
+import java.nio.file.Files
+import java.nio.file.Path
+
+import groovy.transform.CompileStatic
+
+import org.gradle.api.NamedDomainObjectContainer
+import org.gradle.api.Plugin
+import org.gradle.api.Project
+import org.gradle.api.plugins.quality.Pmd
+import org.gradle.api.plugins.quality.PmdExtension
+import org.gradle.api.plugins.quality.PmdPlugin
+import org.gradle.api.provider.Provider
+
+import com.github.spotbugs.snom.Confidence
+import com.github.spotbugs.snom.Effort
+import com.github.spotbugs.snom.SpotBugsExtension
+import com.github.spotbugs.snom.SpotBugsPlugin
+import com.github.spotbugs.snom.SpotBugsReport
+import com.github.spotbugs.snom.SpotBugsTask
+
+/**
+ * Convention plugin for Grails byte code analysis (PMD and SpotBugs).
+ * Both tools are opt-in; enable via Gradle properties.
+ */
+@CompileStatic
+class GrailsCodeAnalysisPlugin implements Plugin<Project> {
+
+    static String PMD_DIR_PROPERTY = 'grails.codeanalysis.dir.pmd'
+    static String PMD_ENABLED_PROPERTY = 'grails.codeanalysis.enabled.pmd'
+    static String PMD_CONFIG_FILE_NAME = 'pmd.xml'
+
+    static String SPOTBUGS_ENABLED_PROPERTY = 
'grails.codeanalysis.enabled.spotbugs'
+
+    static String IGNORE_FAILURES_PROPERTY = 
'grails.codeanalysis.ignoreFailures'
+    static String TEST_ANALYSIS_PROPERTY = 'grails.codeanalysis.enabled.tests'
+
+    static String BASE_RESOURCE_PATH = 
'/META-INF/org.apache.grails.buildsrc.grails-code-analysis'
+
+    @Override
+    void apply(Project project) {
+        initExtension(project)
+        configurePmd(project)
+        configureSpotbugs(project)
+
+        // withType returns a live empty collection when the tool is not 
enabled,
+        // so these dependsOn calls are safe regardless of whether 
PMD/SpotBugs are active
+        project.tasks.register('codeAnalysis') { task ->
+            task.group = 'verification'
+            task.description = 'Runs code analysis checks (PMD, SpotBugs)'
+            task.dependsOn(project.tasks.withType(Pmd))
+            task.dependsOn(project.tasks.withType(SpotBugsTask))
+        }
+    }
+
+    private static void initExtension(Project project) {
+        def gca = project.extensions.create('grailsCodeAnalysis', 
GrailsCodeAnalysisExtension)
+
+        gca.pmdDirectory.set(project.provider {
+            def directory = project.hasProperty(PMD_DIR_PROPERTY) ?
+                    
project.rootProject.layout.projectDirectory.dir(project.property(PMD_DIR_PROPERTY)
 as String) :
+                    
project.rootProject.layout.buildDirectory.get().dir('codeanalysis').dir('pmd')
+
+            def toCreate = directory.asFile.toPath()
+            Files.createDirectories(toCreate)
+
+            createOrLoad(
+                    toCreate.resolve(PMD_CONFIG_FILE_NAME),
+                    "${BASE_RESOURCE_PATH}/pmd/${PMD_CONFIG_FILE_NAME}",
+                    project
+            )
+
+            directory
+        })
+    }
+
+    private static void createOrLoad(Path expectedPath, String 
defaultResource, Project project) {
+        boolean defaultPath = 
expectedPath.startsWith(project.rootProject.buildDir.toPath())
+        if (!Files.exists(expectedPath) || expectedPath.size() == 0 || 
defaultPath) {
+            def defaultValue = 
GrailsCodeAnalysisPlugin.getResourceAsStream(defaultResource)
+            if (!defaultValue) {
+                throw new IllegalStateException("Could not locate default 
configuration file: ${defaultResource}")
+            }
+            project.logger.info('Replacing code analysis configuration')
+            expectedPath.text = defaultValue.text
+        }
+    }
+
+    static void configurePmd(Project project) {
+        Provider<Boolean> pmdEnabled = GradleUtils.booleanProvider(project, 
PMD_ENABLED_PROPERTY)
+        if (!pmdEnabled.get()) {
+            return
+        }
+
+        project.pluginManager.apply(PmdPlugin)
+
+        Provider<Boolean> ignoreFailures = 
GradleUtils.booleanProvider(project, IGNORE_FAILURES_PROPERTY)
+        Provider<Boolean> testStylingEnabled = 
GradleUtils.booleanProvider(project, TEST_ANALYSIS_PROPERTY)
+
+        project.extensions.configure(PmdExtension) {
+            it.ruleSetFiles = 
project.files(project.extensions.getByType(GrailsCodeAnalysisExtension).pmdDirectory.file(PMD_CONFIG_FILE_NAME))
+            it.ruleSets = []
+            it.ignoreFailures = ignoreFailures.get()
+            it.consoleOutput = true
+            it.toolVersion = project.findProperty('pmdVersion')
+        }
+
+        project.tasks.withType(Pmd).configureEach { Pmd task ->
+            task.group = 'verification'
+            task.onlyIf { !project.hasProperty('skipCodeStyle') }
+            task.ignoreFailures = ignoreFailures.get()
+
+            if (task.name.contains('Test') || task.name.contains('test')) {
+                task.enabled = testStylingEnabled.get()
+            }
+
+            task.reports.xml.required.set(true)
+            task.reports.xml.outputLocation.set(
+                    project.extensions.getByType(GrailsCodeAnalysisExtension)
+                            .reportsDirectory.get()
+                            .dir('pmd')
+                            .file("${project.name}-${task.name}.xml")
+            )
+        }
+    }
+
+    static void configureSpotbugs(Project project) {
+        Provider<Boolean> spotbugsEnabled = 
GradleUtils.booleanProvider(project, SPOTBUGS_ENABLED_PROPERTY)
+        if (!spotbugsEnabled.get()) {
+            return
+        }
+
+        project.pluginManager.apply(SpotBugsPlugin)
+
+        Provider<Boolean> ignoreFailures = 
GradleUtils.booleanProvider(project, IGNORE_FAILURES_PROPERTY)
+        Provider<Boolean> testStylingEnabled = 
GradleUtils.booleanProvider(project, TEST_ANALYSIS_PROPERTY)
+
+        project.extensions.configure(SpotBugsExtension) {
+            it.effort.set(Effort.valueOf('MAX'))
+            it.reportLevel.set(Confidence.valueOf('HIGH'))
+            it.ignoreFailures.set(ignoreFailures)
+        }
+
+        project.tasks.withType(SpotBugsTask).configureEach { SpotBugsTask task 
->
+            task.group = 'verification'
+            NamedDomainObjectContainer<SpotBugsReport> spotBugsReports = 
task.reports
+            SpotBugsReport htmlReport = spotBugsReports.maybeCreate('html')
+            htmlReport.required.set(true)
+            SpotBugsReport xmlReport = spotBugsReports.maybeCreate('xml')

Review Comment:
   `def`?



##########
build-logic/plugins/src/main/groovy/org/apache/grails/buildsrc/GrailsCodeStyleExtension.groovy:
##########
@@ -50,10 +50,10 @@ class GrailsCodeStyleExtension {
     @Inject
     GrailsCodeStyleExtension(ObjectFactory objects, Project project) {
         checkstyleDirectory = objects.directoryProperty().convention(
-                project.rootProject.layout.buildDirectory.dir('checkstyle')
+                
project.rootProject.layout.buildDirectory.dir('codestyle/checkstyle')
         )
         codenarcDirectory = objects.directoryProperty().convention(
-                project.rootProject.layout.buildDirectory.dir('codenarc')
+                
project.rootProject.layout.buildDirectory.dir('codestyle/codenarc')
         )
         reportsDirectory = objects.directoryProperty().convention(
                 
project.rootProject.layout.buildDirectory.dir('reports/codestyle')

Review Comment:
   This was not added in this PR but should probably be `code-style`?



##########
build-logic/plugins/src/main/groovy/org/apache/grails/buildsrc/GrailsViolationAggregationPlugin.groovy:
##########
@@ -0,0 +1,501 @@
+/*
+ *  Licensed to the Apache Software Foundation (ASF) under one
+ *  or more contributor license agreements.  See the NOTICE file
+ *  distributed with this work for additional information
+ *  regarding copyright ownership.  The ASF licenses this file
+ *  to you under the Apache License, Version 2.0 (the
+ *  "License"); you may not use this file except in compliance
+ *  with the License.  You may obtain a copy of the License at
+ *
+ *    https://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing,
+ *  software distributed under the License is distributed on an
+ *  "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ *  KIND, either express or implied.  See the License for the
+ *  specific language governing permissions and limitations
+ *  under the License.
+ */
+package org.apache.grails.buildsrc
+
+import java.time.LocalDateTime
+import java.time.format.DateTimeFormatter
+
+import groovy.transform.CompileDynamic
+import groovy.transform.CompileStatic
+
+import org.gradle.api.GradleException
+import org.gradle.api.Plugin
+import org.gradle.api.Project
+import org.gradle.api.Task
+import org.gradle.api.file.Directory
+import org.gradle.api.file.FileCollection
+import org.gradle.api.logging.Logger
+import org.gradle.api.logging.Logging
+import org.gradle.api.plugins.AppliedPlugin
+import org.gradle.api.plugins.quality.Checkstyle
+import org.gradle.api.plugins.quality.CodeNarc
+import org.gradle.api.plugins.quality.Pmd
+import org.gradle.api.provider.Provider
+import org.gradle.api.tasks.TaskProvider
+import org.gradle.testing.jacoco.tasks.JacocoReport
+
+import com.github.spotbugs.snom.SpotBugsTask
+import groovy.xml.XmlSlurper
+
+/**
+ * Root-only convention plugin that aggregates code-style violation XML 
reports and JaCoCo coverage
+ * CSV reports into human-readable Markdown files under 
build/reports/violations/.
+ *
+ * Apply this plugin to the root project only. Subprojects should apply
+ * grails-code-style and grails-jacoco individually.
+ *
+ * Tasks registered:
+ *   aggregateStyleViolations    — CodeNarc + Checkstyle only
+ *   aggregateAnalysisViolations — PMD + SpotBugs only (requires opt-in 
properties)
+ *   aggregateViolations         — depends on both of the above
+ *   aggregateJacocoCoverage     — JaCoCo CSV → Markdown
+ */
+@CompileStatic
+class GrailsViolationAggregationPlugin implements Plugin<Project> {
+
+    private static final Logger LOGGER = 
Logging.getLogger(GrailsViolationAggregationPlugin)
+
+    /**
+     * Comma-separated list of fully-qualified class-name prefixes to exclude 
from the aggregated
+     * JaCoCo coverage report. Configure via {@code 
-Pgrails.jacoco.aggregation.excludedClassPrefixes=...}
+     * or in {@code gradle.properties}.
+     *
+     * <p>Defaults to {@link #DEFAULT_JACOCO_EXCLUDED_CLASS_PREFIXES}: the 
Hibernate 7 support classes
+     * share fully-qualified names with their Hibernate 5 counterparts, and 
JaCoCo cannot aggregate
+     * coverage for two different classes with the same name (it fails with
+     * "Can't add different class with same name"). Excluding one variant 
keeps the aggregate valid.
+     */
+    static final String JACOCO_EXCLUDED_CLASS_PREFIXES_PROPERTY = 
'grails.jacoco.aggregation.excludedClassPrefixes'
+
+    static final String DEFAULT_JACOCO_EXCLUDED_CLASS_PREFIXES = 
'org.grails.orm.hibernate.support.hibernate7.'
+
+    @Override
+    void apply(Project project) {
+        if (project != project.rootProject) {
+            throw new GradleException(
+                'GrailsViolationAggregationPlugin must be applied to the root 
project only. ' +
+                'Apply grails-code-style and grails-jacoco to subprojects 
instead.'
+            )
+        }
+
+        Provider<Directory> violationsDir = 
project.layout.buildDirectory.dir('reports/violations')
+        Provider<Directory> styleXmlDir = 
project.layout.buildDirectory.dir('reports/codestyle')

Review Comment:
   `code-style`?



##########
build-logic/plugins/src/main/groovy/org/apache/grails/buildsrc/GrailsViolationAggregationPlugin.groovy:
##########
@@ -0,0 +1,501 @@
+/*
+ *  Licensed to the Apache Software Foundation (ASF) under one
+ *  or more contributor license agreements.  See the NOTICE file
+ *  distributed with this work for additional information
+ *  regarding copyright ownership.  The ASF licenses this file
+ *  to you under the Apache License, Version 2.0 (the
+ *  "License"); you may not use this file except in compliance
+ *  with the License.  You may obtain a copy of the License at
+ *
+ *    https://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing,
+ *  software distributed under the License is distributed on an
+ *  "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ *  KIND, either express or implied.  See the License for the
+ *  specific language governing permissions and limitations
+ *  under the License.
+ */
+package org.apache.grails.buildsrc
+
+import java.time.LocalDateTime
+import java.time.format.DateTimeFormatter
+
+import groovy.transform.CompileDynamic
+import groovy.transform.CompileStatic
+
+import org.gradle.api.GradleException
+import org.gradle.api.Plugin
+import org.gradle.api.Project
+import org.gradle.api.Task
+import org.gradle.api.file.Directory
+import org.gradle.api.file.FileCollection
+import org.gradle.api.logging.Logger
+import org.gradle.api.logging.Logging
+import org.gradle.api.plugins.AppliedPlugin
+import org.gradle.api.plugins.quality.Checkstyle
+import org.gradle.api.plugins.quality.CodeNarc
+import org.gradle.api.plugins.quality.Pmd
+import org.gradle.api.provider.Provider
+import org.gradle.api.tasks.TaskProvider
+import org.gradle.testing.jacoco.tasks.JacocoReport
+
+import com.github.spotbugs.snom.SpotBugsTask
+import groovy.xml.XmlSlurper
+
+/**
+ * Root-only convention plugin that aggregates code-style violation XML 
reports and JaCoCo coverage
+ * CSV reports into human-readable Markdown files under 
build/reports/violations/.
+ *
+ * Apply this plugin to the root project only. Subprojects should apply
+ * grails-code-style and grails-jacoco individually.
+ *
+ * Tasks registered:
+ *   aggregateStyleViolations    — CodeNarc + Checkstyle only
+ *   aggregateAnalysisViolations — PMD + SpotBugs only (requires opt-in 
properties)
+ *   aggregateViolations         — depends on both of the above
+ *   aggregateJacocoCoverage     — JaCoCo CSV → Markdown
+ */
+@CompileStatic
+class GrailsViolationAggregationPlugin implements Plugin<Project> {
+
+    private static final Logger LOGGER = 
Logging.getLogger(GrailsViolationAggregationPlugin)
+
+    /**
+     * Comma-separated list of fully-qualified class-name prefixes to exclude 
from the aggregated
+     * JaCoCo coverage report. Configure via {@code 
-Pgrails.jacoco.aggregation.excludedClassPrefixes=...}
+     * or in {@code gradle.properties}.
+     *
+     * <p>Defaults to {@link #DEFAULT_JACOCO_EXCLUDED_CLASS_PREFIXES}: the 
Hibernate 7 support classes
+     * share fully-qualified names with their Hibernate 5 counterparts, and 
JaCoCo cannot aggregate
+     * coverage for two different classes with the same name (it fails with
+     * "Can't add different class with same name"). Excluding one variant 
keeps the aggregate valid.
+     */
+    static final String JACOCO_EXCLUDED_CLASS_PREFIXES_PROPERTY = 
'grails.jacoco.aggregation.excludedClassPrefixes'
+
+    static final String DEFAULT_JACOCO_EXCLUDED_CLASS_PREFIXES = 
'org.grails.orm.hibernate.support.hibernate7.'
+
+    @Override
+    void apply(Project project) {
+        if (project != project.rootProject) {
+            throw new GradleException(
+                'GrailsViolationAggregationPlugin must be applied to the root 
project only. ' +
+                'Apply grails-code-style and grails-jacoco to subprojects 
instead.'
+            )
+        }
+
+        Provider<Directory> violationsDir = 
project.layout.buildDirectory.dir('reports/violations')
+        Provider<Directory> styleXmlDir = 
project.layout.buildDirectory.dir('reports/codestyle')
+        Provider<Directory> analysisXmlDir = 
project.layout.buildDirectory.dir('reports/codeanalysis')

Review Comment:
   `code-analysis`?



##########
build-logic/plugins/src/main/groovy/org/apache/grails/buildsrc/GrailsCodeAnalysisPlugin.groovy:
##########
@@ -0,0 +1,183 @@
+/*
+ *  Licensed to the Apache Software Foundation (ASF) under one
+ *  or more contributor license agreements.  See the NOTICE file
+ *  distributed with this work for additional information
+ *  regarding copyright ownership.  The ASF licenses this file
+ *  to you under the Apache License, Version 2.0 (the
+ *  "License"); you may not use this file except in compliance
+ *  with the License.  You may obtain a copy of the License at
+ *
+ *    https://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing,
+ *  software distributed under the License is distributed on an
+ *  "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ *  KIND, either express or implied.  See the License for the
+ *  specific language governing permissions and limitations
+ *  under the License.
+ */
+package org.apache.grails.buildsrc
+
+import java.nio.file.Files
+import java.nio.file.Path
+
+import groovy.transform.CompileStatic
+
+import org.gradle.api.NamedDomainObjectContainer
+import org.gradle.api.Plugin
+import org.gradle.api.Project
+import org.gradle.api.plugins.quality.Pmd
+import org.gradle.api.plugins.quality.PmdExtension
+import org.gradle.api.plugins.quality.PmdPlugin
+import org.gradle.api.provider.Provider
+
+import com.github.spotbugs.snom.Confidence
+import com.github.spotbugs.snom.Effort
+import com.github.spotbugs.snom.SpotBugsExtension
+import com.github.spotbugs.snom.SpotBugsPlugin
+import com.github.spotbugs.snom.SpotBugsReport
+import com.github.spotbugs.snom.SpotBugsTask
+
+/**
+ * Convention plugin for Grails byte code analysis (PMD and SpotBugs).
+ * Both tools are opt-in; enable via Gradle properties.
+ */
+@CompileStatic
+class GrailsCodeAnalysisPlugin implements Plugin<Project> {
+
+    static String PMD_DIR_PROPERTY = 'grails.codeanalysis.dir.pmd'
+    static String PMD_ENABLED_PROPERTY = 'grails.codeanalysis.enabled.pmd'
+    static String PMD_CONFIG_FILE_NAME = 'pmd.xml'
+
+    static String SPOTBUGS_ENABLED_PROPERTY = 
'grails.codeanalysis.enabled.spotbugs'
+
+    static String IGNORE_FAILURES_PROPERTY = 
'grails.codeanalysis.ignoreFailures'
+    static String TEST_ANALYSIS_PROPERTY = 'grails.codeanalysis.enabled.tests'
+
+    static String BASE_RESOURCE_PATH = 
'/META-INF/org.apache.grails.buildsrc.grails-code-analysis'
+
+    @Override
+    void apply(Project project) {
+        initExtension(project)
+        configurePmd(project)
+        configureSpotbugs(project)
+
+        // withType returns a live empty collection when the tool is not 
enabled,
+        // so these dependsOn calls are safe regardless of whether 
PMD/SpotBugs are active
+        project.tasks.register('codeAnalysis') { task ->
+            task.group = 'verification'
+            task.description = 'Runs code analysis checks (PMD, SpotBugs)'
+            task.dependsOn(project.tasks.withType(Pmd))
+            task.dependsOn(project.tasks.withType(SpotBugsTask))
+        }
+    }
+
+    private static void initExtension(Project project) {
+        def gca = project.extensions.create('grailsCodeAnalysis', 
GrailsCodeAnalysisExtension)
+
+        gca.pmdDirectory.set(project.provider {
+            def directory = project.hasProperty(PMD_DIR_PROPERTY) ?
+                    
project.rootProject.layout.projectDirectory.dir(project.property(PMD_DIR_PROPERTY)
 as String) :
+                    
project.rootProject.layout.buildDirectory.get().dir('codeanalysis').dir('pmd')
+
+            def toCreate = directory.asFile.toPath()
+            Files.createDirectories(toCreate)
+
+            createOrLoad(
+                    toCreate.resolve(PMD_CONFIG_FILE_NAME),
+                    "${BASE_RESOURCE_PATH}/pmd/${PMD_CONFIG_FILE_NAME}",
+                    project
+            )
+
+            directory
+        })
+    }
+
+    private static void createOrLoad(Path expectedPath, String 
defaultResource, Project project) {
+        boolean defaultPath = 
expectedPath.startsWith(project.rootProject.buildDir.toPath())
+        if (!Files.exists(expectedPath) || expectedPath.size() == 0 || 
defaultPath) {
+            def defaultValue = 
GrailsCodeAnalysisPlugin.getResourceAsStream(defaultResource)
+            if (!defaultValue) {
+                throw new IllegalStateException("Could not locate default 
configuration file: ${defaultResource}")
+            }
+            project.logger.info('Replacing code analysis configuration')
+            expectedPath.text = defaultValue.text
+        }
+    }
+
+    static void configurePmd(Project project) {
+        Provider<Boolean> pmdEnabled = GradleUtils.booleanProvider(project, 
PMD_ENABLED_PROPERTY)
+        if (!pmdEnabled.get()) {
+            return
+        }
+
+        project.pluginManager.apply(PmdPlugin)
+
+        Provider<Boolean> ignoreFailures = 
GradleUtils.booleanProvider(project, IGNORE_FAILURES_PROPERTY)
+        Provider<Boolean> testStylingEnabled = 
GradleUtils.booleanProvider(project, TEST_ANALYSIS_PROPERTY)
+
+        project.extensions.configure(PmdExtension) {
+            it.ruleSetFiles = 
project.files(project.extensions.getByType(GrailsCodeAnalysisExtension).pmdDirectory.file(PMD_CONFIG_FILE_NAME))
+            it.ruleSets = []
+            it.ignoreFailures = ignoreFailures.get()
+            it.consoleOutput = true
+            it.toolVersion = project.findProperty('pmdVersion')
+        }
+
+        project.tasks.withType(Pmd).configureEach { Pmd task ->
+            task.group = 'verification'
+            task.onlyIf { !project.hasProperty('skipCodeStyle') }
+            task.ignoreFailures = ignoreFailures.get()
+
+            if (task.name.contains('Test') || task.name.contains('test')) {
+                task.enabled = testStylingEnabled.get()
+            }
+
+            task.reports.xml.required.set(true)
+            task.reports.xml.outputLocation.set(
+                    project.extensions.getByType(GrailsCodeAnalysisExtension)
+                            .reportsDirectory.get()
+                            .dir('pmd')
+                            .file("${project.name}-${task.name}.xml")
+            )
+        }
+    }
+
+    static void configureSpotbugs(Project project) {
+        Provider<Boolean> spotbugsEnabled = 
GradleUtils.booleanProvider(project, SPOTBUGS_ENABLED_PROPERTY)

Review Comment:
   `def` where the type can be inferred here and below?



##########
build-logic/plugins/src/main/groovy/org/apache/grails/buildsrc/GrailsCodeAnalysisPlugin.groovy:
##########
@@ -0,0 +1,183 @@
+/*
+ *  Licensed to the Apache Software Foundation (ASF) under one
+ *  or more contributor license agreements.  See the NOTICE file
+ *  distributed with this work for additional information
+ *  regarding copyright ownership.  The ASF licenses this file
+ *  to you under the Apache License, Version 2.0 (the
+ *  "License"); you may not use this file except in compliance
+ *  with the License.  You may obtain a copy of the License at
+ *
+ *    https://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing,
+ *  software distributed under the License is distributed on an
+ *  "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ *  KIND, either express or implied.  See the License for the
+ *  specific language governing permissions and limitations
+ *  under the License.
+ */
+package org.apache.grails.buildsrc
+
+import java.nio.file.Files
+import java.nio.file.Path
+
+import groovy.transform.CompileStatic
+
+import org.gradle.api.NamedDomainObjectContainer
+import org.gradle.api.Plugin
+import org.gradle.api.Project
+import org.gradle.api.plugins.quality.Pmd
+import org.gradle.api.plugins.quality.PmdExtension
+import org.gradle.api.plugins.quality.PmdPlugin
+import org.gradle.api.provider.Provider
+
+import com.github.spotbugs.snom.Confidence
+import com.github.spotbugs.snom.Effort
+import com.github.spotbugs.snom.SpotBugsExtension
+import com.github.spotbugs.snom.SpotBugsPlugin
+import com.github.spotbugs.snom.SpotBugsReport
+import com.github.spotbugs.snom.SpotBugsTask
+
+/**
+ * Convention plugin for Grails byte code analysis (PMD and SpotBugs).
+ * Both tools are opt-in; enable via Gradle properties.
+ */
+@CompileStatic
+class GrailsCodeAnalysisPlugin implements Plugin<Project> {
+
+    static String PMD_DIR_PROPERTY = 'grails.codeanalysis.dir.pmd'
+    static String PMD_ENABLED_PROPERTY = 'grails.codeanalysis.enabled.pmd'
+    static String PMD_CONFIG_FILE_NAME = 'pmd.xml'
+
+    static String SPOTBUGS_ENABLED_PROPERTY = 
'grails.codeanalysis.enabled.spotbugs'
+
+    static String IGNORE_FAILURES_PROPERTY = 
'grails.codeanalysis.ignoreFailures'
+    static String TEST_ANALYSIS_PROPERTY = 'grails.codeanalysis.enabled.tests'
+
+    static String BASE_RESOURCE_PATH = 
'/META-INF/org.apache.grails.buildsrc.grails-code-analysis'
+
+    @Override
+    void apply(Project project) {
+        initExtension(project)
+        configurePmd(project)
+        configureSpotbugs(project)
+
+        // withType returns a live empty collection when the tool is not 
enabled,
+        // so these dependsOn calls are safe regardless of whether 
PMD/SpotBugs are active
+        project.tasks.register('codeAnalysis') { task ->
+            task.group = 'verification'
+            task.description = 'Runs code analysis checks (PMD, SpotBugs)'
+            task.dependsOn(project.tasks.withType(Pmd))
+            task.dependsOn(project.tasks.withType(SpotBugsTask))
+        }
+    }
+
+    private static void initExtension(Project project) {
+        def gca = project.extensions.create('grailsCodeAnalysis', 
GrailsCodeAnalysisExtension)
+
+        gca.pmdDirectory.set(project.provider {
+            def directory = project.hasProperty(PMD_DIR_PROPERTY) ?
+                    
project.rootProject.layout.projectDirectory.dir(project.property(PMD_DIR_PROPERTY)
 as String) :
+                    
project.rootProject.layout.buildDirectory.get().dir('codeanalysis').dir('pmd')

Review Comment:
   `code-analysis`?



##########
build-logic/plugins/src/main/groovy/org/apache/grails/buildsrc/GrailsCodeStylePlugin.groovy:
##########
@@ -168,20 +172,33 @@ class GrailsCodeStylePlugin implements Plugin<Project> {
     static void configureCodenarc(Project project) {
         project.pluginManager.apply(CodeNarcPlugin)
 
+        registerCodenarcFixTask(project)
+
+        Provider<Boolean> ignoreFailures = 
GradleUtils.booleanProvider(project, IGNORE_FAILURES_PROPERTY)

Review Comment:
   `def` here and below?



##########
build-logic/plugins/src/main/groovy/org/apache/grails/buildsrc/GrailsCodeAnalysisPlugin.groovy:
##########
@@ -0,0 +1,183 @@
+/*
+ *  Licensed to the Apache Software Foundation (ASF) under one
+ *  or more contributor license agreements.  See the NOTICE file
+ *  distributed with this work for additional information
+ *  regarding copyright ownership.  The ASF licenses this file
+ *  to you under the Apache License, Version 2.0 (the
+ *  "License"); you may not use this file except in compliance
+ *  with the License.  You may obtain a copy of the License at
+ *
+ *    https://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing,
+ *  software distributed under the License is distributed on an
+ *  "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ *  KIND, either express or implied.  See the License for the
+ *  specific language governing permissions and limitations
+ *  under the License.
+ */
+package org.apache.grails.buildsrc
+
+import java.nio.file.Files
+import java.nio.file.Path
+
+import groovy.transform.CompileStatic
+
+import org.gradle.api.NamedDomainObjectContainer
+import org.gradle.api.Plugin
+import org.gradle.api.Project
+import org.gradle.api.plugins.quality.Pmd
+import org.gradle.api.plugins.quality.PmdExtension
+import org.gradle.api.plugins.quality.PmdPlugin
+import org.gradle.api.provider.Provider
+
+import com.github.spotbugs.snom.Confidence
+import com.github.spotbugs.snom.Effort
+import com.github.spotbugs.snom.SpotBugsExtension
+import com.github.spotbugs.snom.SpotBugsPlugin
+import com.github.spotbugs.snom.SpotBugsReport
+import com.github.spotbugs.snom.SpotBugsTask
+
+/**
+ * Convention plugin for Grails byte code analysis (PMD and SpotBugs).
+ * Both tools are opt-in; enable via Gradle properties.
+ */
+@CompileStatic
+class GrailsCodeAnalysisPlugin implements Plugin<Project> {
+
+    static String PMD_DIR_PROPERTY = 'grails.codeanalysis.dir.pmd'
+    static String PMD_ENABLED_PROPERTY = 'grails.codeanalysis.enabled.pmd'
+    static String PMD_CONFIG_FILE_NAME = 'pmd.xml'
+
+    static String SPOTBUGS_ENABLED_PROPERTY = 
'grails.codeanalysis.enabled.spotbugs'
+
+    static String IGNORE_FAILURES_PROPERTY = 
'grails.codeanalysis.ignoreFailures'
+    static String TEST_ANALYSIS_PROPERTY = 'grails.codeanalysis.enabled.tests'
+
+    static String BASE_RESOURCE_PATH = 
'/META-INF/org.apache.grails.buildsrc.grails-code-analysis'
+
+    @Override
+    void apply(Project project) {
+        initExtension(project)
+        configurePmd(project)
+        configureSpotbugs(project)
+
+        // withType returns a live empty collection when the tool is not 
enabled,
+        // so these dependsOn calls are safe regardless of whether 
PMD/SpotBugs are active
+        project.tasks.register('codeAnalysis') { task ->
+            task.group = 'verification'
+            task.description = 'Runs code analysis checks (PMD, SpotBugs)'
+            task.dependsOn(project.tasks.withType(Pmd))
+            task.dependsOn(project.tasks.withType(SpotBugsTask))
+        }
+    }
+
+    private static void initExtension(Project project) {
+        def gca = project.extensions.create('grailsCodeAnalysis', 
GrailsCodeAnalysisExtension)
+
+        gca.pmdDirectory.set(project.provider {
+            def directory = project.hasProperty(PMD_DIR_PROPERTY) ?
+                    
project.rootProject.layout.projectDirectory.dir(project.property(PMD_DIR_PROPERTY)
 as String) :
+                    
project.rootProject.layout.buildDirectory.get().dir('codeanalysis').dir('pmd')
+
+            def toCreate = directory.asFile.toPath()
+            Files.createDirectories(toCreate)
+
+            createOrLoad(
+                    toCreate.resolve(PMD_CONFIG_FILE_NAME),
+                    "${BASE_RESOURCE_PATH}/pmd/${PMD_CONFIG_FILE_NAME}",
+                    project
+            )
+
+            directory
+        })
+    }
+
+    private static void createOrLoad(Path expectedPath, String 
defaultResource, Project project) {
+        boolean defaultPath = 
expectedPath.startsWith(project.rootProject.buildDir.toPath())
+        if (!Files.exists(expectedPath) || expectedPath.size() == 0 || 
defaultPath) {
+            def defaultValue = 
GrailsCodeAnalysisPlugin.getResourceAsStream(defaultResource)
+            if (!defaultValue) {
+                throw new IllegalStateException("Could not locate default 
configuration file: ${defaultResource}")
+            }
+            project.logger.info('Replacing code analysis configuration')
+            expectedPath.text = defaultValue.text
+        }
+    }
+
+    static void configurePmd(Project project) {
+        Provider<Boolean> pmdEnabled = GradleUtils.booleanProvider(project, 
PMD_ENABLED_PROPERTY)

Review Comment:
   `def` here and below where the type can be inferred?



##########
build-logic/plugins/src/main/groovy/org/apache/grails/buildsrc/GrailsCodeAnalysisPlugin.groovy:
##########
@@ -0,0 +1,183 @@
+/*
+ *  Licensed to the Apache Software Foundation (ASF) under one
+ *  or more contributor license agreements.  See the NOTICE file
+ *  distributed with this work for additional information
+ *  regarding copyright ownership.  The ASF licenses this file
+ *  to you under the Apache License, Version 2.0 (the
+ *  "License"); you may not use this file except in compliance
+ *  with the License.  You may obtain a copy of the License at
+ *
+ *    https://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing,
+ *  software distributed under the License is distributed on an
+ *  "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ *  KIND, either express or implied.  See the License for the
+ *  specific language governing permissions and limitations
+ *  under the License.
+ */
+package org.apache.grails.buildsrc
+
+import java.nio.file.Files
+import java.nio.file.Path
+
+import groovy.transform.CompileStatic
+
+import org.gradle.api.NamedDomainObjectContainer
+import org.gradle.api.Plugin
+import org.gradle.api.Project
+import org.gradle.api.plugins.quality.Pmd
+import org.gradle.api.plugins.quality.PmdExtension
+import org.gradle.api.plugins.quality.PmdPlugin
+import org.gradle.api.provider.Provider
+
+import com.github.spotbugs.snom.Confidence
+import com.github.spotbugs.snom.Effort
+import com.github.spotbugs.snom.SpotBugsExtension
+import com.github.spotbugs.snom.SpotBugsPlugin
+import com.github.spotbugs.snom.SpotBugsReport
+import com.github.spotbugs.snom.SpotBugsTask
+
+/**
+ * Convention plugin for Grails byte code analysis (PMD and SpotBugs).
+ * Both tools are opt-in; enable via Gradle properties.
+ */
+@CompileStatic
+class GrailsCodeAnalysisPlugin implements Plugin<Project> {
+
+    static String PMD_DIR_PROPERTY = 'grails.codeanalysis.dir.pmd'

Review Comment:
   Can we use hyphened `code-analysis` here and below?



##########
build-logic/plugins/src/main/groovy/org/apache/grails/buildsrc/GrailsCodeAnalysisPlugin.groovy:
##########
@@ -0,0 +1,183 @@
+/*
+ *  Licensed to the Apache Software Foundation (ASF) under one
+ *  or more contributor license agreements.  See the NOTICE file
+ *  distributed with this work for additional information
+ *  regarding copyright ownership.  The ASF licenses this file
+ *  to you under the Apache License, Version 2.0 (the
+ *  "License"); you may not use this file except in compliance
+ *  with the License.  You may obtain a copy of the License at
+ *
+ *    https://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing,
+ *  software distributed under the License is distributed on an
+ *  "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ *  KIND, either express or implied.  See the License for the
+ *  specific language governing permissions and limitations
+ *  under the License.
+ */
+package org.apache.grails.buildsrc
+
+import java.nio.file.Files
+import java.nio.file.Path
+
+import groovy.transform.CompileStatic
+
+import org.gradle.api.NamedDomainObjectContainer
+import org.gradle.api.Plugin
+import org.gradle.api.Project
+import org.gradle.api.plugins.quality.Pmd
+import org.gradle.api.plugins.quality.PmdExtension
+import org.gradle.api.plugins.quality.PmdPlugin
+import org.gradle.api.provider.Provider
+
+import com.github.spotbugs.snom.Confidence
+import com.github.spotbugs.snom.Effort
+import com.github.spotbugs.snom.SpotBugsExtension
+import com.github.spotbugs.snom.SpotBugsPlugin
+import com.github.spotbugs.snom.SpotBugsReport
+import com.github.spotbugs.snom.SpotBugsTask
+
+/**
+ * Convention plugin for Grails byte code analysis (PMD and SpotBugs).
+ * Both tools are opt-in; enable via Gradle properties.
+ */
+@CompileStatic
+class GrailsCodeAnalysisPlugin implements Plugin<Project> {
+
+    static String PMD_DIR_PROPERTY = 'grails.codeanalysis.dir.pmd'
+    static String PMD_ENABLED_PROPERTY = 'grails.codeanalysis.enabled.pmd'
+    static String PMD_CONFIG_FILE_NAME = 'pmd.xml'
+
+    static String SPOTBUGS_ENABLED_PROPERTY = 
'grails.codeanalysis.enabled.spotbugs'
+
+    static String IGNORE_FAILURES_PROPERTY = 
'grails.codeanalysis.ignoreFailures'
+    static String TEST_ANALYSIS_PROPERTY = 'grails.codeanalysis.enabled.tests'
+
+    static String BASE_RESOURCE_PATH = 
'/META-INF/org.apache.grails.buildsrc.grails-code-analysis'
+
+    @Override
+    void apply(Project project) {
+        initExtension(project)
+        configurePmd(project)
+        configureSpotbugs(project)
+
+        // withType returns a live empty collection when the tool is not 
enabled,
+        // so these dependsOn calls are safe regardless of whether 
PMD/SpotBugs are active
+        project.tasks.register('codeAnalysis') { task ->
+            task.group = 'verification'
+            task.description = 'Runs code analysis checks (PMD, SpotBugs)'
+            task.dependsOn(project.tasks.withType(Pmd))
+            task.dependsOn(project.tasks.withType(SpotBugsTask))
+        }
+    }
+
+    private static void initExtension(Project project) {
+        def gca = project.extensions.create('grailsCodeAnalysis', 
GrailsCodeAnalysisExtension)
+
+        gca.pmdDirectory.set(project.provider {
+            def directory = project.hasProperty(PMD_DIR_PROPERTY) ?
+                    
project.rootProject.layout.projectDirectory.dir(project.property(PMD_DIR_PROPERTY)
 as String) :
+                    
project.rootProject.layout.buildDirectory.get().dir('codeanalysis').dir('pmd')
+
+            def toCreate = directory.asFile.toPath()
+            Files.createDirectories(toCreate)
+
+            createOrLoad(
+                    toCreate.resolve(PMD_CONFIG_FILE_NAME),
+                    "${BASE_RESOURCE_PATH}/pmd/${PMD_CONFIG_FILE_NAME}",
+                    project
+            )
+
+            directory
+        })
+    }
+
+    private static void createOrLoad(Path expectedPath, String 
defaultResource, Project project) {
+        boolean defaultPath = 
expectedPath.startsWith(project.rootProject.buildDir.toPath())
+        if (!Files.exists(expectedPath) || expectedPath.size() == 0 || 
defaultPath) {
+            def defaultValue = 
GrailsCodeAnalysisPlugin.getResourceAsStream(defaultResource)
+            if (!defaultValue) {
+                throw new IllegalStateException("Could not locate default 
configuration file: ${defaultResource}")
+            }
+            project.logger.info('Replacing code analysis configuration')
+            expectedPath.text = defaultValue.text
+        }
+    }
+
+    static void configurePmd(Project project) {
+        Provider<Boolean> pmdEnabled = GradleUtils.booleanProvider(project, 
PMD_ENABLED_PROPERTY)
+        if (!pmdEnabled.get()) {
+            return
+        }
+
+        project.pluginManager.apply(PmdPlugin)
+
+        Provider<Boolean> ignoreFailures = 
GradleUtils.booleanProvider(project, IGNORE_FAILURES_PROPERTY)
+        Provider<Boolean> testStylingEnabled = 
GradleUtils.booleanProvider(project, TEST_ANALYSIS_PROPERTY)
+
+        project.extensions.configure(PmdExtension) {
+            it.ruleSetFiles = 
project.files(project.extensions.getByType(GrailsCodeAnalysisExtension).pmdDirectory.file(PMD_CONFIG_FILE_NAME))
+            it.ruleSets = []
+            it.ignoreFailures = ignoreFailures.get()
+            it.consoleOutput = true
+            it.toolVersion = project.findProperty('pmdVersion')
+        }
+
+        project.tasks.withType(Pmd).configureEach { Pmd task ->
+            task.group = 'verification'
+            task.onlyIf { !project.hasProperty('skipCodeStyle') }
+            task.ignoreFailures = ignoreFailures.get()
+
+            if (task.name.contains('Test') || task.name.contains('test')) {
+                task.enabled = testStylingEnabled.get()
+            }
+
+            task.reports.xml.required.set(true)
+            task.reports.xml.outputLocation.set(
+                    project.extensions.getByType(GrailsCodeAnalysisExtension)
+                            .reportsDirectory.get()
+                            .dir('pmd')
+                            .file("${project.name}-${task.name}.xml")
+            )
+        }
+    }
+
+    static void configureSpotbugs(Project project) {
+        Provider<Boolean> spotbugsEnabled = 
GradleUtils.booleanProvider(project, SPOTBUGS_ENABLED_PROPERTY)
+        if (!spotbugsEnabled.get()) {
+            return
+        }
+
+        project.pluginManager.apply(SpotBugsPlugin)
+
+        Provider<Boolean> ignoreFailures = 
GradleUtils.booleanProvider(project, IGNORE_FAILURES_PROPERTY)
+        Provider<Boolean> testStylingEnabled = 
GradleUtils.booleanProvider(project, TEST_ANALYSIS_PROPERTY)
+
+        project.extensions.configure(SpotBugsExtension) {
+            it.effort.set(Effort.valueOf('MAX'))
+            it.reportLevel.set(Confidence.valueOf('HIGH'))
+            it.ignoreFailures.set(ignoreFailures)
+        }
+
+        project.tasks.withType(SpotBugsTask).configureEach { SpotBugsTask task 
->
+            task.group = 'verification'
+            NamedDomainObjectContainer<SpotBugsReport> spotBugsReports = 
task.reports

Review Comment:
   `def`?



##########
build-logic/plugins/src/main/groovy/org/apache/grails/buildsrc/GrailsCodeStylePlugin.groovy:
##########
@@ -131,31 +126,40 @@ class GrailsCodeStylePlugin implements Plugin<Project> {
         project.tasks.register('codeStyle') {
             it.group = 'verification'
             it.description = 'Runs code style checks'
-            it.dependsOn(project.tasks.withType(Checkstyle))
             it.dependsOn(project.tasks.withType(CodeNarc))
+            it.dependsOn(project.tasks.withType(Checkstyle))
         }
     }
 
     static void configureCheckstyle(Project project) {
         project.pluginManager.apply(CheckstylePlugin)
 
+        Provider<Boolean> ignoreFailures = 
GradleUtils.booleanProvider(project, IGNORE_FAILURES_PROPERTY)

Review Comment:
   `def`?



##########
build-logic/plugins/src/main/groovy/org/apache/grails/buildsrc/GrailsCodeAnalysisPlugin.groovy:
##########
@@ -0,0 +1,183 @@
+/*
+ *  Licensed to the Apache Software Foundation (ASF) under one
+ *  or more contributor license agreements.  See the NOTICE file
+ *  distributed with this work for additional information
+ *  regarding copyright ownership.  The ASF licenses this file
+ *  to you under the Apache License, Version 2.0 (the
+ *  "License"); you may not use this file except in compliance
+ *  with the License.  You may obtain a copy of the License at
+ *
+ *    https://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing,
+ *  software distributed under the License is distributed on an
+ *  "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ *  KIND, either express or implied.  See the License for the
+ *  specific language governing permissions and limitations
+ *  under the License.
+ */
+package org.apache.grails.buildsrc
+
+import java.nio.file.Files
+import java.nio.file.Path
+
+import groovy.transform.CompileStatic
+
+import org.gradle.api.NamedDomainObjectContainer
+import org.gradle.api.Plugin
+import org.gradle.api.Project
+import org.gradle.api.plugins.quality.Pmd
+import org.gradle.api.plugins.quality.PmdExtension
+import org.gradle.api.plugins.quality.PmdPlugin
+import org.gradle.api.provider.Provider
+
+import com.github.spotbugs.snom.Confidence
+import com.github.spotbugs.snom.Effort
+import com.github.spotbugs.snom.SpotBugsExtension
+import com.github.spotbugs.snom.SpotBugsPlugin
+import com.github.spotbugs.snom.SpotBugsReport
+import com.github.spotbugs.snom.SpotBugsTask
+
+/**
+ * Convention plugin for Grails byte code analysis (PMD and SpotBugs).
+ * Both tools are opt-in; enable via Gradle properties.
+ */
+@CompileStatic
+class GrailsCodeAnalysisPlugin implements Plugin<Project> {
+
+    static String PMD_DIR_PROPERTY = 'grails.codeanalysis.dir.pmd'
+    static String PMD_ENABLED_PROPERTY = 'grails.codeanalysis.enabled.pmd'
+    static String PMD_CONFIG_FILE_NAME = 'pmd.xml'
+
+    static String SPOTBUGS_ENABLED_PROPERTY = 
'grails.codeanalysis.enabled.spotbugs'
+
+    static String IGNORE_FAILURES_PROPERTY = 
'grails.codeanalysis.ignoreFailures'
+    static String TEST_ANALYSIS_PROPERTY = 'grails.codeanalysis.enabled.tests'
+
+    static String BASE_RESOURCE_PATH = 
'/META-INF/org.apache.grails.buildsrc.grails-code-analysis'
+
+    @Override
+    void apply(Project project) {
+        initExtension(project)
+        configurePmd(project)
+        configureSpotbugs(project)
+
+        // withType returns a live empty collection when the tool is not 
enabled,
+        // so these dependsOn calls are safe regardless of whether 
PMD/SpotBugs are active
+        project.tasks.register('codeAnalysis') { task ->
+            task.group = 'verification'
+            task.description = 'Runs code analysis checks (PMD, SpotBugs)'
+            task.dependsOn(project.tasks.withType(Pmd))
+            task.dependsOn(project.tasks.withType(SpotBugsTask))
+        }
+    }
+
+    private static void initExtension(Project project) {
+        def gca = project.extensions.create('grailsCodeAnalysis', 
GrailsCodeAnalysisExtension)
+
+        gca.pmdDirectory.set(project.provider {
+            def directory = project.hasProperty(PMD_DIR_PROPERTY) ?
+                    
project.rootProject.layout.projectDirectory.dir(project.property(PMD_DIR_PROPERTY)
 as String) :
+                    
project.rootProject.layout.buildDirectory.get().dir('codeanalysis').dir('pmd')
+
+            def toCreate = directory.asFile.toPath()
+            Files.createDirectories(toCreate)
+
+            createOrLoad(
+                    toCreate.resolve(PMD_CONFIG_FILE_NAME),
+                    "${BASE_RESOURCE_PATH}/pmd/${PMD_CONFIG_FILE_NAME}",
+                    project
+            )
+
+            directory
+        })
+    }
+
+    private static void createOrLoad(Path expectedPath, String 
defaultResource, Project project) {
+        boolean defaultPath = 
expectedPath.startsWith(project.rootProject.buildDir.toPath())
+        if (!Files.exists(expectedPath) || expectedPath.size() == 0 || 
defaultPath) {
+            def defaultValue = 
GrailsCodeAnalysisPlugin.getResourceAsStream(defaultResource)
+            if (!defaultValue) {
+                throw new IllegalStateException("Could not locate default 
configuration file: ${defaultResource}")
+            }
+            project.logger.info('Replacing code analysis configuration')
+            expectedPath.text = defaultValue.text
+        }
+    }
+
+    static void configurePmd(Project project) {
+        Provider<Boolean> pmdEnabled = GradleUtils.booleanProvider(project, 
PMD_ENABLED_PROPERTY)
+        if (!pmdEnabled.get()) {
+            return
+        }
+
+        project.pluginManager.apply(PmdPlugin)
+
+        Provider<Boolean> ignoreFailures = 
GradleUtils.booleanProvider(project, IGNORE_FAILURES_PROPERTY)
+        Provider<Boolean> testStylingEnabled = 
GradleUtils.booleanProvider(project, TEST_ANALYSIS_PROPERTY)
+
+        project.extensions.configure(PmdExtension) {
+            it.ruleSetFiles = 
project.files(project.extensions.getByType(GrailsCodeAnalysisExtension).pmdDirectory.file(PMD_CONFIG_FILE_NAME))
+            it.ruleSets = []
+            it.ignoreFailures = ignoreFailures.get()
+            it.consoleOutput = true
+            it.toolVersion = project.findProperty('pmdVersion')
+        }
+
+        project.tasks.withType(Pmd).configureEach { Pmd task ->
+            task.group = 'verification'
+            task.onlyIf { !project.hasProperty('skipCodeStyle') }
+            task.ignoreFailures = ignoreFailures.get()
+
+            if (task.name.contains('Test') || task.name.contains('test')) {
+                task.enabled = testStylingEnabled.get()
+            }
+
+            task.reports.xml.required.set(true)
+            task.reports.xml.outputLocation.set(
+                    project.extensions.getByType(GrailsCodeAnalysisExtension)
+                            .reportsDirectory.get()
+                            .dir('pmd')
+                            .file("${project.name}-${task.name}.xml")
+            )
+        }
+    }
+
+    static void configureSpotbugs(Project project) {
+        Provider<Boolean> spotbugsEnabled = 
GradleUtils.booleanProvider(project, SPOTBUGS_ENABLED_PROPERTY)
+        if (!spotbugsEnabled.get()) {
+            return
+        }
+
+        project.pluginManager.apply(SpotBugsPlugin)
+
+        Provider<Boolean> ignoreFailures = 
GradleUtils.booleanProvider(project, IGNORE_FAILURES_PROPERTY)
+        Provider<Boolean> testStylingEnabled = 
GradleUtils.booleanProvider(project, TEST_ANALYSIS_PROPERTY)
+
+        project.extensions.configure(SpotBugsExtension) {
+            it.effort.set(Effort.valueOf('MAX'))
+            it.reportLevel.set(Confidence.valueOf('HIGH'))
+            it.ignoreFailures.set(ignoreFailures)
+        }
+
+        project.tasks.withType(SpotBugsTask).configureEach { SpotBugsTask task 
->
+            task.group = 'verification'
+            NamedDomainObjectContainer<SpotBugsReport> spotBugsReports = 
task.reports
+            SpotBugsReport htmlReport = spotBugsReports.maybeCreate('html')

Review Comment:
   `def`?



##########
build-logic/plugins/src/main/groovy/org/apache/grails/buildsrc/GrailsCodeStylePlugin.groovy:
##########
@@ -21,44 +21,52 @@ package org.apache.grails.buildsrc
 import java.nio.file.Files
 import java.nio.file.Path
 
+import groovy.transform.CompileDynamic
 import groovy.transform.CompileStatic
 
 import org.gradle.api.Plugin
 import org.gradle.api.Project
-import org.gradle.api.file.Directory
 import org.gradle.api.plugins.quality.Checkstyle
 import org.gradle.api.plugins.quality.CheckstyleExtension
 import org.gradle.api.plugins.quality.CheckstylePlugin
 import org.gradle.api.plugins.quality.CodeNarc
 import org.gradle.api.plugins.quality.CodeNarcExtension
 import org.gradle.api.plugins.quality.CodeNarcPlugin
+import org.gradle.api.provider.Provider
 
+/**
+ * Convention plugin for Grails code style enforcement (Checkstyle and 
CodeNarc).
+ */
 @CompileStatic
 class GrailsCodeStylePlugin implements Plugin<Project> {
 
     static String CHECKSTYLE_DIR_PROPERTY = 'grails.codestyle.dir.checkstyle'

Review Comment:
   Camel or kebab for `codestyle` here and below?



##########
build-logic/plugins/src/main/groovy/org/apache/grails/buildsrc/GrailsViolationAggregationPlugin.groovy:
##########
@@ -0,0 +1,501 @@
+/*
+ *  Licensed to the Apache Software Foundation (ASF) under one
+ *  or more contributor license agreements.  See the NOTICE file
+ *  distributed with this work for additional information
+ *  regarding copyright ownership.  The ASF licenses this file
+ *  to you under the Apache License, Version 2.0 (the
+ *  "License"); you may not use this file except in compliance
+ *  with the License.  You may obtain a copy of the License at
+ *
+ *    https://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing,
+ *  software distributed under the License is distributed on an
+ *  "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ *  KIND, either express or implied.  See the License for the
+ *  specific language governing permissions and limitations
+ *  under the License.
+ */
+package org.apache.grails.buildsrc
+
+import java.time.LocalDateTime
+import java.time.format.DateTimeFormatter
+
+import groovy.transform.CompileDynamic
+import groovy.transform.CompileStatic
+
+import org.gradle.api.GradleException
+import org.gradle.api.Plugin
+import org.gradle.api.Project
+import org.gradle.api.Task
+import org.gradle.api.file.Directory
+import org.gradle.api.file.FileCollection
+import org.gradle.api.logging.Logger
+import org.gradle.api.logging.Logging
+import org.gradle.api.plugins.AppliedPlugin
+import org.gradle.api.plugins.quality.Checkstyle
+import org.gradle.api.plugins.quality.CodeNarc
+import org.gradle.api.plugins.quality.Pmd
+import org.gradle.api.provider.Provider
+import org.gradle.api.tasks.TaskProvider
+import org.gradle.testing.jacoco.tasks.JacocoReport
+
+import com.github.spotbugs.snom.SpotBugsTask
+import groovy.xml.XmlSlurper

Review Comment:
   Order imports?



##########
build-logic/plugins/src/main/groovy/org/apache/grails/buildsrc/GrailsCodeStylePlugin.groovy:
##########
@@ -131,31 +126,40 @@ class GrailsCodeStylePlugin implements Plugin<Project> {
         project.tasks.register('codeStyle') {
             it.group = 'verification'
             it.description = 'Runs code style checks'
-            it.dependsOn(project.tasks.withType(Checkstyle))
             it.dependsOn(project.tasks.withType(CodeNarc))
+            it.dependsOn(project.tasks.withType(Checkstyle))
         }
     }
 
     static void configureCheckstyle(Project project) {
         project.pluginManager.apply(CheckstylePlugin)
 
+        Provider<Boolean> ignoreFailures = 
GradleUtils.booleanProvider(project, IGNORE_FAILURES_PROPERTY)
+
         project.extensions.configure(CheckstyleExtension) {
             // Explicit `it` is required in extension configuration
             
it.getConfigDirectory().set(project.extensions.getByType(GrailsCodeStyleExtension).checkstyleDirectory)

Review Comment:
   Not changed in this PR but could use groovy property accessor. 



##########
build-logic/plugins/src/main/groovy/org/apache/grails/buildsrc/GrailsCodeStylePlugin.groovy:
##########
@@ -131,31 +126,40 @@ class GrailsCodeStylePlugin implements Plugin<Project> {
         project.tasks.register('codeStyle') {
             it.group = 'verification'
             it.description = 'Runs code style checks'
-            it.dependsOn(project.tasks.withType(Checkstyle))
             it.dependsOn(project.tasks.withType(CodeNarc))
+            it.dependsOn(project.tasks.withType(Checkstyle))
         }
     }
 
     static void configureCheckstyle(Project project) {
         project.pluginManager.apply(CheckstylePlugin)
 
+        Provider<Boolean> ignoreFailures = 
GradleUtils.booleanProvider(project, IGNORE_FAILURES_PROPERTY)
+
         project.extensions.configure(CheckstyleExtension) {
             // Explicit `it` is required in extension configuration
             
it.getConfigDirectory().set(project.extensions.getByType(GrailsCodeStyleExtension).checkstyleDirectory)
             it.maxWarnings = 0
             it.showViolations = true
-            it.ignoreFailures = false
+            it.ignoreFailures = ignoreFailures.get()
             it.toolVersion = project.findProperty('checkstyleVersion')
         }
 
         project.tasks.withType(Checkstyle).configureEach { Checkstyle task ->
             task.group = 'verification'
             task.onlyIf { !project.hasProperty('skipCodeStyle') }
+            task.ignoreFailures = ignoreFailures.get()
+
+            if (task.name.toLowerCase().contains('test')) {
+                task.enabled = false
+            }
+
+            task.exclude { org.gradle.api.file.FileTreeElement element ->
+                element.getFile().getAbsolutePath().contains("/build/")

Review Comment:
   - Add comment why this is necessary and for which projects?
   - Will this work on Windows?
   - Use Groovy property accessors?



##########
build-logic/plugins/src/main/groovy/org/apache/grails/buildsrc/GrailsViolationAggregationPlugin.groovy:
##########
@@ -0,0 +1,501 @@
+/*
+ *  Licensed to the Apache Software Foundation (ASF) under one
+ *  or more contributor license agreements.  See the NOTICE file
+ *  distributed with this work for additional information
+ *  regarding copyright ownership.  The ASF licenses this file
+ *  to you under the Apache License, Version 2.0 (the
+ *  "License"); you may not use this file except in compliance
+ *  with the License.  You may obtain a copy of the License at
+ *
+ *    https://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing,
+ *  software distributed under the License is distributed on an
+ *  "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ *  KIND, either express or implied.  See the License for the
+ *  specific language governing permissions and limitations
+ *  under the License.
+ */
+package org.apache.grails.buildsrc
+
+import java.time.LocalDateTime
+import java.time.format.DateTimeFormatter
+
+import groovy.transform.CompileDynamic
+import groovy.transform.CompileStatic
+
+import org.gradle.api.GradleException
+import org.gradle.api.Plugin
+import org.gradle.api.Project
+import org.gradle.api.Task
+import org.gradle.api.file.Directory
+import org.gradle.api.file.FileCollection
+import org.gradle.api.logging.Logger
+import org.gradle.api.logging.Logging
+import org.gradle.api.plugins.AppliedPlugin
+import org.gradle.api.plugins.quality.Checkstyle
+import org.gradle.api.plugins.quality.CodeNarc
+import org.gradle.api.plugins.quality.Pmd
+import org.gradle.api.provider.Provider
+import org.gradle.api.tasks.TaskProvider
+import org.gradle.testing.jacoco.tasks.JacocoReport
+
+import com.github.spotbugs.snom.SpotBugsTask
+import groovy.xml.XmlSlurper
+
+/**
+ * Root-only convention plugin that aggregates code-style violation XML 
reports and JaCoCo coverage
+ * CSV reports into human-readable Markdown files under 
build/reports/violations/.
+ *
+ * Apply this plugin to the root project only. Subprojects should apply
+ * grails-code-style and grails-jacoco individually.
+ *
+ * Tasks registered:
+ *   aggregateStyleViolations    — CodeNarc + Checkstyle only
+ *   aggregateAnalysisViolations — PMD + SpotBugs only (requires opt-in 
properties)
+ *   aggregateViolations         — depends on both of the above
+ *   aggregateJacocoCoverage     — JaCoCo CSV → Markdown
+ */
+@CompileStatic
+class GrailsViolationAggregationPlugin implements Plugin<Project> {
+
+    private static final Logger LOGGER = 
Logging.getLogger(GrailsViolationAggregationPlugin)
+
+    /**
+     * Comma-separated list of fully-qualified class-name prefixes to exclude 
from the aggregated
+     * JaCoCo coverage report. Configure via {@code 
-Pgrails.jacoco.aggregation.excludedClassPrefixes=...}
+     * or in {@code gradle.properties}.
+     *
+     * <p>Defaults to {@link #DEFAULT_JACOCO_EXCLUDED_CLASS_PREFIXES}: the 
Hibernate 7 support classes
+     * share fully-qualified names with their Hibernate 5 counterparts, and 
JaCoCo cannot aggregate
+     * coverage for two different classes with the same name (it fails with
+     * "Can't add different class with same name"). Excluding one variant 
keeps the aggregate valid.
+     */
+    static final String JACOCO_EXCLUDED_CLASS_PREFIXES_PROPERTY = 
'grails.jacoco.aggregation.excludedClassPrefixes'
+
+    static final String DEFAULT_JACOCO_EXCLUDED_CLASS_PREFIXES = 
'org.grails.orm.hibernate.support.hibernate7.'
+
+    @Override
+    void apply(Project project) {
+        if (project != project.rootProject) {
+            throw new GradleException(
+                'GrailsViolationAggregationPlugin must be applied to the root 
project only. ' +
+                'Apply grails-code-style and grails-jacoco to subprojects 
instead.'
+            )
+        }
+
+        Provider<Directory> violationsDir = 
project.layout.buildDirectory.dir('reports/violations')
+        Provider<Directory> styleXmlDir = 
project.layout.buildDirectory.dir('reports/codestyle')
+        Provider<Directory> analysisXmlDir = 
project.layout.buildDirectory.dir('reports/codeanalysis')
+
+        TaskProvider<Task> styleTask = registerStyleAggregation(project, 
styleXmlDir, violationsDir)
+        TaskProvider<Task> analysisTask = registerAnalysisAggregation(project, 
analysisXmlDir, violationsDir)
+        registerJacocoAggregation(project, violationsDir)
+
+        project.tasks.register('aggregateViolations') { Task task ->
+            task.group = 'verification'
+            task.description = 'Aggregates all violation reports (style + 
analysis) into build/reports/violations/'
+            task.dependsOn(styleTask, analysisTask)
+        }
+    }
+
+    private static TaskProvider<Task> registerStyleAggregation(Project root, 
Provider<Directory> styleXmlDir, Provider<Directory> violationsDir) {
+        // Wire property flags as Providers — values are resolved at task 
execution time, not at apply() time,
+        // and Providers are configuration-cache safe to capture in task 
actions
+        Provider<Boolean> checkStyleTests = GradleUtils.booleanProvider(root, 
GrailsCodeStylePlugin.TEST_STYLING_PROPERTY)
+        Provider<Boolean> codenarcEnabled = GradleUtils.booleanProvider(root, 
GrailsCodeStylePlugin.CODENARC_ENABLED_PROPERTY, true)
+        Provider<Boolean> checkstyleEnabled = 
GradleUtils.booleanProvider(root, 
GrailsCodeStylePlugin.CHECKSTYLE_ENABLED_PROPERTY, true)
+
+        TaskProvider<Task> aggregateTask = 
root.tasks.register('aggregateStyleViolations') { Task task ->
+            task.group = 'verification'
+            task.description = 'Aggregates CodeNarc and Checkstyle violation 
reports into build/reports/violations/'
+            
task.outputs.file(root.file('build/reports/violations/CODENARC_VIOLATIONS.md'))
+            
task.outputs.file(root.file('build/reports/violations/CHECKSTYLE_VIOLATIONS.md'))
+            task.doLast {
+                parseStyleViolations(styleXmlDir.get(), violationsDir.get(),
+                    checkStyleTests.get(), codenarcEnabled.get(), 
checkstyleEnabled.get())
+            }
+        }
+        root.subprojects { Project sub ->
+            sub.pluginManager.withPlugin('codenarc') { AppliedPlugin p ->
+                aggregateTask.configure { Task task ->
+                    task.dependsOn(sub.tasks.withType(CodeNarc))
+                }
+            }
+            sub.pluginManager.withPlugin('checkstyle') { AppliedPlugin p ->
+                aggregateTask.configure { Task task ->
+                    task.dependsOn(sub.tasks.withType(Checkstyle))
+                }
+            }
+        }
+        aggregateTask
+    }
+
+    private static TaskProvider<Task> registerAnalysisAggregation(Project 
root, Provider<Directory> analysisXmlDir, Provider<Directory> violationsDir) {
+        Provider<Boolean> checkAnalysisTests = 
GradleUtils.booleanProvider(root, 
GrailsCodeAnalysisPlugin.TEST_ANALYSIS_PROPERTY)
+        Provider<Boolean> pmdEnabled = GradleUtils.booleanProvider(root, 
GrailsCodeAnalysisPlugin.PMD_ENABLED_PROPERTY)
+        Provider<Boolean> spotbugsEnabled = GradleUtils.booleanProvider(root, 
GrailsCodeAnalysisPlugin.SPOTBUGS_ENABLED_PROPERTY)
+
+        TaskProvider<Task> aggregateTask = 
root.tasks.register('aggregateAnalysisViolations') { Task task ->
+            task.group = 'verification'
+            task.description = 'Aggregates PMD and SpotBugs violation reports 
into build/reports/violations/'
+            
task.outputs.file(root.file('build/reports/violations/PMD_VIOLATIONS.md'))
+            
task.outputs.file(root.file('build/reports/violations/SPOTBUGS_VIOLATIONS.md'))
+            task.doLast {
+                parseAnalysisViolations(analysisXmlDir.get(), 
violationsDir.get(),
+                    checkAnalysisTests.get(), pmdEnabled.get(), 
spotbugsEnabled.get())
+            }
+        }
+        root.subprojects { Project sub ->
+            sub.pluginManager.withPlugin('pmd') { AppliedPlugin p ->
+                aggregateTask.configure { Task task ->
+                    task.dependsOn(sub.tasks.withType(Pmd))
+                }
+            }
+            sub.pluginManager.withPlugin('com.github.spotbugs') { 
AppliedPlugin p ->
+                aggregateTask.configure { Task task ->
+                    task.dependsOn(sub.tasks.withType(SpotBugsTask))
+                }
+            }
+        }
+        aggregateTask
+    }
+
+    private static void registerJacocoAggregation(Project root, 
Provider<Directory> violationsDir) {
+        // Collect all potential CSV paths at configuration time — Project 
must not be referenced from task actions
+        FileCollection jacocoCsvFiles = root.files(
+            root.allprojects.collect { Project p -> 
p.file('build/reports/jacoco/test/jacocoTestReport.csv') }
+        )
+
+        // Resolve the excluded class-name prefixes as a Provider so the value 
is captured
+        // configuration-cache-safely and read at task execution time.
+        Provider<List<String>> excludedClassPrefixes = root.providers
+            .gradleProperty(JACOCO_EXCLUDED_CLASS_PREFIXES_PROPERTY)
+            .orElse(DEFAULT_JACOCO_EXCLUDED_CLASS_PREFIXES)
+            .map { String value ->
+                value.split(',').collect { it.trim() }.findAll { !it.isEmpty() 
}
+            }
+
+        TaskProvider<Task> aggregateTask = 
root.tasks.register('aggregateJacocoCoverage') { Task task ->
+            task.group = 'verification'
+            task.description = 'Aggregates JaCoCo coverage reports from all 
subprojects into build/reports/violations/'
+            task.inputs.files(jacocoCsvFiles).optional(true)
+            task.inputs.property('excludedClassPrefixes', 
excludedClassPrefixes)
+            
task.outputs.file(root.file('build/reports/violations/JACOCO_COVERAGE.md'))
+            task.doLast {
+                parseJacocoCoverage(jacocoCsvFiles, violationsDir.get(), 
excludedClassPrefixes.get())
+            }
+        }
+        root.subprojects { Project sub ->
+            sub.pluginManager.withPlugin('jacoco') { AppliedPlugin p ->
+                aggregateTask.configure { Task task ->
+                    task.dependsOn(sub.tasks.withType(JacocoReport))
+                }
+            }
+        }
+    }
+
+    @CompileDynamic
+    private static void parseStyleViolations(Directory styleXmlDir, Directory 
violationsDir,
+            boolean checkStyleTests, boolean codenarcEnabled, boolean 
checkstyleEnabled) {
+        def slurper = new XmlSlurper()
+        
slurper.setFeature('http://apache.org/xml/features/disallow-doctype-decl', true)
+        
slurper.setFeature('http://apache.org/xml/features/nonvalidating/load-external-dtd',
 false)
+        
slurper.setFeature('http://xml.org/sax/features/external-general-entities', 
false)
+        
slurper.setFeature('http://xml.org/sax/features/external-parameter-entities', 
false)
+        slurper.setFeature('http://xml.org/sax/features/namespaces', false)
+
+        def getModule = { String fileName ->
+            def lastDash = fileName.lastIndexOf('-')
+            lastDash != -1 ? fileName.substring(0, lastDash) : fileName
+        }
+
+        def isTestFile = { String fileName ->
+            fileName.toLowerCase().contains('test') || 
fileName.toLowerCase().contains('integrationtest')
+        }
+
+        def shouldSkipClass = { boolean includeTests, String className, String 
filePath = null ->
+            if (includeTests) {
+                return false
+            }
+            if (filePath && (filePath.contains('src/test/') || 
filePath.contains('src/integrationTest/'))) {
+                return true
+            }
+            !filePath && (className.contains('Spec') || 
className.contains('Test') || className.contains('Tests'))
+        }
+
+        def writeReport = { String fileName, List violations, String title ->

Review Comment:
   Looks like there is some duplication here?



##########
build-logic/plugins/src/main/groovy/org/apache/grails/buildsrc/GrailsCodeStyleExtension.groovy:
##########
@@ -30,13 +30,13 @@ import org.gradle.api.model.ObjectFactory
 class GrailsCodeStyleExtension {
 
     /**
-     * Defaults to project.buildDir/checkstyle.
+     * Defaults to project.rootProject.buildDir/codestyle/checkstyle.

Review Comment:
   - Align javadoc path?
   - `code-style`?



##########
build-logic/plugins/src/main/groovy/org/apache/grails/buildsrc/GrailsViolationAggregationPlugin.groovy:
##########
@@ -0,0 +1,501 @@
+/*
+ *  Licensed to the Apache Software Foundation (ASF) under one
+ *  or more contributor license agreements.  See the NOTICE file
+ *  distributed with this work for additional information
+ *  regarding copyright ownership.  The ASF licenses this file
+ *  to you under the Apache License, Version 2.0 (the
+ *  "License"); you may not use this file except in compliance
+ *  with the License.  You may obtain a copy of the License at
+ *
+ *    https://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing,
+ *  software distributed under the License is distributed on an
+ *  "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ *  KIND, either express or implied.  See the License for the
+ *  specific language governing permissions and limitations
+ *  under the License.
+ */
+package org.apache.grails.buildsrc
+
+import java.time.LocalDateTime
+import java.time.format.DateTimeFormatter
+
+import groovy.transform.CompileDynamic
+import groovy.transform.CompileStatic
+
+import org.gradle.api.GradleException
+import org.gradle.api.Plugin
+import org.gradle.api.Project
+import org.gradle.api.Task
+import org.gradle.api.file.Directory
+import org.gradle.api.file.FileCollection
+import org.gradle.api.logging.Logger
+import org.gradle.api.logging.Logging
+import org.gradle.api.plugins.AppliedPlugin
+import org.gradle.api.plugins.quality.Checkstyle
+import org.gradle.api.plugins.quality.CodeNarc
+import org.gradle.api.plugins.quality.Pmd
+import org.gradle.api.provider.Provider
+import org.gradle.api.tasks.TaskProvider
+import org.gradle.testing.jacoco.tasks.JacocoReport
+
+import com.github.spotbugs.snom.SpotBugsTask
+import groovy.xml.XmlSlurper
+
+/**
+ * Root-only convention plugin that aggregates code-style violation XML 
reports and JaCoCo coverage
+ * CSV reports into human-readable Markdown files under 
build/reports/violations/.
+ *
+ * Apply this plugin to the root project only. Subprojects should apply
+ * grails-code-style and grails-jacoco individually.
+ *
+ * Tasks registered:
+ *   aggregateStyleViolations    — CodeNarc + Checkstyle only
+ *   aggregateAnalysisViolations — PMD + SpotBugs only (requires opt-in 
properties)
+ *   aggregateViolations         — depends on both of the above
+ *   aggregateJacocoCoverage     — JaCoCo CSV → Markdown
+ */
+@CompileStatic
+class GrailsViolationAggregationPlugin implements Plugin<Project> {
+
+    private static final Logger LOGGER = 
Logging.getLogger(GrailsViolationAggregationPlugin)
+
+    /**
+     * Comma-separated list of fully-qualified class-name prefixes to exclude 
from the aggregated
+     * JaCoCo coverage report. Configure via {@code 
-Pgrails.jacoco.aggregation.excludedClassPrefixes=...}
+     * or in {@code gradle.properties}.
+     *
+     * <p>Defaults to {@link #DEFAULT_JACOCO_EXCLUDED_CLASS_PREFIXES}: the 
Hibernate 7 support classes
+     * share fully-qualified names with their Hibernate 5 counterparts, and 
JaCoCo cannot aggregate
+     * coverage for two different classes with the same name (it fails with
+     * "Can't add different class with same name"). Excluding one variant 
keeps the aggregate valid.
+     */
+    static final String JACOCO_EXCLUDED_CLASS_PREFIXES_PROPERTY = 
'grails.jacoco.aggregation.excludedClassPrefixes'
+
+    static final String DEFAULT_JACOCO_EXCLUDED_CLASS_PREFIXES = 
'org.grails.orm.hibernate.support.hibernate7.'
+
+    @Override
+    void apply(Project project) {
+        if (project != project.rootProject) {
+            throw new GradleException(
+                'GrailsViolationAggregationPlugin must be applied to the root 
project only. ' +
+                'Apply grails-code-style and grails-jacoco to subprojects 
instead.'
+            )
+        }
+
+        Provider<Directory> violationsDir = 
project.layout.buildDirectory.dir('reports/violations')

Review Comment:
   `def` here and below?



##########
build-logic/plugins/src/main/groovy/org/apache/grails/buildsrc/GrailsViolationAggregationPlugin.groovy:
##########
@@ -0,0 +1,501 @@
+/*
+ *  Licensed to the Apache Software Foundation (ASF) under one
+ *  or more contributor license agreements.  See the NOTICE file
+ *  distributed with this work for additional information
+ *  regarding copyright ownership.  The ASF licenses this file
+ *  to you under the Apache License, Version 2.0 (the
+ *  "License"); you may not use this file except in compliance
+ *  with the License.  You may obtain a copy of the License at
+ *
+ *    https://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing,
+ *  software distributed under the License is distributed on an
+ *  "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ *  KIND, either express or implied.  See the License for the
+ *  specific language governing permissions and limitations
+ *  under the License.
+ */
+package org.apache.grails.buildsrc
+
+import java.time.LocalDateTime
+import java.time.format.DateTimeFormatter
+
+import groovy.transform.CompileDynamic
+import groovy.transform.CompileStatic
+
+import org.gradle.api.GradleException
+import org.gradle.api.Plugin
+import org.gradle.api.Project
+import org.gradle.api.Task
+import org.gradle.api.file.Directory
+import org.gradle.api.file.FileCollection
+import org.gradle.api.logging.Logger
+import org.gradle.api.logging.Logging
+import org.gradle.api.plugins.AppliedPlugin
+import org.gradle.api.plugins.quality.Checkstyle
+import org.gradle.api.plugins.quality.CodeNarc
+import org.gradle.api.plugins.quality.Pmd
+import org.gradle.api.provider.Provider
+import org.gradle.api.tasks.TaskProvider
+import org.gradle.testing.jacoco.tasks.JacocoReport
+
+import com.github.spotbugs.snom.SpotBugsTask
+import groovy.xml.XmlSlurper
+
+/**
+ * Root-only convention plugin that aggregates code-style violation XML 
reports and JaCoCo coverage
+ * CSV reports into human-readable Markdown files under 
build/reports/violations/.
+ *
+ * Apply this plugin to the root project only. Subprojects should apply
+ * grails-code-style and grails-jacoco individually.
+ *
+ * Tasks registered:
+ *   aggregateStyleViolations    — CodeNarc + Checkstyle only
+ *   aggregateAnalysisViolations — PMD + SpotBugs only (requires opt-in 
properties)
+ *   aggregateViolations         — depends on both of the above
+ *   aggregateJacocoCoverage     — JaCoCo CSV → Markdown
+ */
+@CompileStatic
+class GrailsViolationAggregationPlugin implements Plugin<Project> {
+
+    private static final Logger LOGGER = 
Logging.getLogger(GrailsViolationAggregationPlugin)
+
+    /**
+     * Comma-separated list of fully-qualified class-name prefixes to exclude 
from the aggregated
+     * JaCoCo coverage report. Configure via {@code 
-Pgrails.jacoco.aggregation.excludedClassPrefixes=...}
+     * or in {@code gradle.properties}.
+     *
+     * <p>Defaults to {@link #DEFAULT_JACOCO_EXCLUDED_CLASS_PREFIXES}: the 
Hibernate 7 support classes
+     * share fully-qualified names with their Hibernate 5 counterparts, and 
JaCoCo cannot aggregate
+     * coverage for two different classes with the same name (it fails with
+     * "Can't add different class with same name"). Excluding one variant 
keeps the aggregate valid.
+     */
+    static final String JACOCO_EXCLUDED_CLASS_PREFIXES_PROPERTY = 
'grails.jacoco.aggregation.excludedClassPrefixes'
+
+    static final String DEFAULT_JACOCO_EXCLUDED_CLASS_PREFIXES = 
'org.grails.orm.hibernate.support.hibernate7.'
+
+    @Override
+    void apply(Project project) {
+        if (project != project.rootProject) {
+            throw new GradleException(
+                'GrailsViolationAggregationPlugin must be applied to the root 
project only. ' +
+                'Apply grails-code-style and grails-jacoco to subprojects 
instead.'
+            )
+        }
+
+        Provider<Directory> violationsDir = 
project.layout.buildDirectory.dir('reports/violations')
+        Provider<Directory> styleXmlDir = 
project.layout.buildDirectory.dir('reports/codestyle')
+        Provider<Directory> analysisXmlDir = 
project.layout.buildDirectory.dir('reports/codeanalysis')
+
+        TaskProvider<Task> styleTask = registerStyleAggregation(project, 
styleXmlDir, violationsDir)
+        TaskProvider<Task> analysisTask = registerAnalysisAggregation(project, 
analysisXmlDir, violationsDir)
+        registerJacocoAggregation(project, violationsDir)
+
+        project.tasks.register('aggregateViolations') { Task task ->
+            task.group = 'verification'
+            task.description = 'Aggregates all violation reports (style + 
analysis) into build/reports/violations/'
+            task.dependsOn(styleTask, analysisTask)
+        }
+    }
+
+    private static TaskProvider<Task> registerStyleAggregation(Project root, 
Provider<Directory> styleXmlDir, Provider<Directory> violationsDir) {
+        // Wire property flags as Providers — values are resolved at task 
execution time, not at apply() time,
+        // and Providers are configuration-cache safe to capture in task 
actions
+        Provider<Boolean> checkStyleTests = GradleUtils.booleanProvider(root, 
GrailsCodeStylePlugin.TEST_STYLING_PROPERTY)
+        Provider<Boolean> codenarcEnabled = GradleUtils.booleanProvider(root, 
GrailsCodeStylePlugin.CODENARC_ENABLED_PROPERTY, true)
+        Provider<Boolean> checkstyleEnabled = 
GradleUtils.booleanProvider(root, 
GrailsCodeStylePlugin.CHECKSTYLE_ENABLED_PROPERTY, true)
+
+        TaskProvider<Task> aggregateTask = 
root.tasks.register('aggregateStyleViolations') { Task task ->
+            task.group = 'verification'
+            task.description = 'Aggregates CodeNarc and Checkstyle violation 
reports into build/reports/violations/'
+            
task.outputs.file(root.file('build/reports/violations/CODENARC_VIOLATIONS.md'))
+            
task.outputs.file(root.file('build/reports/violations/CHECKSTYLE_VIOLATIONS.md'))
+            task.doLast {
+                parseStyleViolations(styleXmlDir.get(), violationsDir.get(),
+                    checkStyleTests.get(), codenarcEnabled.get(), 
checkstyleEnabled.get())
+            }
+        }
+        root.subprojects { Project sub ->
+            sub.pluginManager.withPlugin('codenarc') { AppliedPlugin p ->
+                aggregateTask.configure { Task task ->
+                    task.dependsOn(sub.tasks.withType(CodeNarc))
+                }
+            }
+            sub.pluginManager.withPlugin('checkstyle') { AppliedPlugin p ->
+                aggregateTask.configure { Task task ->
+                    task.dependsOn(sub.tasks.withType(Checkstyle))
+                }
+            }
+        }
+        aggregateTask
+    }
+
+    private static TaskProvider<Task> registerAnalysisAggregation(Project 
root, Provider<Directory> analysisXmlDir, Provider<Directory> violationsDir) {
+        Provider<Boolean> checkAnalysisTests = 
GradleUtils.booleanProvider(root, 
GrailsCodeAnalysisPlugin.TEST_ANALYSIS_PROPERTY)
+        Provider<Boolean> pmdEnabled = GradleUtils.booleanProvider(root, 
GrailsCodeAnalysisPlugin.PMD_ENABLED_PROPERTY)
+        Provider<Boolean> spotbugsEnabled = GradleUtils.booleanProvider(root, 
GrailsCodeAnalysisPlugin.SPOTBUGS_ENABLED_PROPERTY)
+
+        TaskProvider<Task> aggregateTask = 
root.tasks.register('aggregateAnalysisViolations') { Task task ->
+            task.group = 'verification'
+            task.description = 'Aggregates PMD and SpotBugs violation reports 
into build/reports/violations/'
+            
task.outputs.file(root.file('build/reports/violations/PMD_VIOLATIONS.md'))
+            
task.outputs.file(root.file('build/reports/violations/SPOTBUGS_VIOLATIONS.md'))
+            task.doLast {
+                parseAnalysisViolations(analysisXmlDir.get(), 
violationsDir.get(),
+                    checkAnalysisTests.get(), pmdEnabled.get(), 
spotbugsEnabled.get())
+            }
+        }
+        root.subprojects { Project sub ->
+            sub.pluginManager.withPlugin('pmd') { AppliedPlugin p ->
+                aggregateTask.configure { Task task ->
+                    task.dependsOn(sub.tasks.withType(Pmd))
+                }
+            }
+            sub.pluginManager.withPlugin('com.github.spotbugs') { 
AppliedPlugin p ->
+                aggregateTask.configure { Task task ->
+                    task.dependsOn(sub.tasks.withType(SpotBugsTask))
+                }
+            }
+        }
+        aggregateTask
+    }
+
+    private static void registerJacocoAggregation(Project root, 
Provider<Directory> violationsDir) {
+        // Collect all potential CSV paths at configuration time — Project 
must not be referenced from task actions
+        FileCollection jacocoCsvFiles = root.files(
+            root.allprojects.collect { Project p -> 
p.file('build/reports/jacoco/test/jacocoTestReport.csv') }
+        )
+
+        // Resolve the excluded class-name prefixes as a Provider so the value 
is captured
+        // configuration-cache-safely and read at task execution time.
+        Provider<List<String>> excludedClassPrefixes = root.providers
+            .gradleProperty(JACOCO_EXCLUDED_CLASS_PREFIXES_PROPERTY)
+            .orElse(DEFAULT_JACOCO_EXCLUDED_CLASS_PREFIXES)
+            .map { String value ->
+                value.split(',').collect { it.trim() }.findAll { !it.isEmpty() 
}
+            }
+
+        TaskProvider<Task> aggregateTask = 
root.tasks.register('aggregateJacocoCoverage') { Task task ->
+            task.group = 'verification'
+            task.description = 'Aggregates JaCoCo coverage reports from all 
subprojects into build/reports/violations/'
+            task.inputs.files(jacocoCsvFiles).optional(true)
+            task.inputs.property('excludedClassPrefixes', 
excludedClassPrefixes)
+            
task.outputs.file(root.file('build/reports/violations/JACOCO_COVERAGE.md'))
+            task.doLast {
+                parseJacocoCoverage(jacocoCsvFiles, violationsDir.get(), 
excludedClassPrefixes.get())
+            }
+        }
+        root.subprojects { Project sub ->
+            sub.pluginManager.withPlugin('jacoco') { AppliedPlugin p ->
+                aggregateTask.configure { Task task ->
+                    task.dependsOn(sub.tasks.withType(JacocoReport))
+                }
+            }
+        }
+    }
+
+    @CompileDynamic
+    private static void parseStyleViolations(Directory styleXmlDir, Directory 
violationsDir,
+            boolean checkStyleTests, boolean codenarcEnabled, boolean 
checkstyleEnabled) {
+        def slurper = new XmlSlurper()

Review Comment:
   Extract duplicate slurper creation into helper?



-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: notifications-unsubscr...@grails.apache.org

For queries about this service, please contact Infrastructure at:
us...@infra.apache.org