jamesfredley commented on PR #15614: URL: https://github.com/apache/grails-core/pull/15614#issuecomment-4357433622
Pushed [`23f586d4f6`](https://github.com/apache/grails-core/pull/15614/commits/23f586d4f6) addressing @jdaugherty's review. ## What changed Moved the shadow jar SBOM wiring **out of** the generic `SbomPlugin` and **into** `grails-forge/grails-cli/build.gradle`, the only project that actually combines `com.gradleup.shadow` with `org.apache.grails.buildsrc.sbom`. * `SbomPlugin` lost `publishSbomForShadowJarProjects` and the raw `Task -> Jar` cast it required, plus the now-unused `import org.gradle.api.Task`. The plugin's only responsibility is back to wiring `cyclonedxDirectBom` into the regular `jar` via `publishSbomForJarProjects`. * `grails-cli/build.gradle` now uses a typed `TaskProvider<CyclonedxDirectTask>` and `cyclonedxDirectBomTask.flatMap { it.jsonOutput }` inside the existing `shadowJarTask.configure { ShadowJar it -> ... }` block. `ShadowJar`, `CyclonedxDirectTask`, `CopySpec`, and `Manifest` are all on the buildscript classpath at that point, so the wiring is fully type-safe with no compile dep added to `build-logic`. * `skipJavaComponent` guard preserved to match the convention used by `publishSbomForJarProjects`. * `:grails-cli-shadow/build.gradle` is unchanged - it already excludes `META-INF/sbom.json` directly because it doesn't apply the SBOM plugin. ## Verification (Gradle 9.4.1, `--rerun-tasks`) | Jar | `serialNumber` | `metadata.component.name` | |---|---|---| | `:grails-cli` (regular) | `urn:uuid:beabd2c0-...` | `grails-cli` | | `:grails-cli` (`-all` FAT) | `urn:uuid:beabd2c0-...` | `grails-cli` | | `:grails-cli-shadow` (`-all` FAT) | _(no SBOM - excluded)_ | _(no SBOM)_ | | `:grails-forge-cli` (regular) | `urn:uuid:401e573c-...` | `grails-forge-cli` | * `:grails-cli`'s regular and `-all` jar share a `serialNumber` by design (same project). * The fat jar's `metadata.component.name` is `grails-cli` (not the leaked `grails-shell-cli` from before the fix). * `:grails-cli-shadow` correctly has no `META-INF/sbom.json` in its fat jar. * `:grails-forge-cli` has a distinct `serialNumber` describing the right module. Replied to both review threads inline. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
