jamesfredley commented on PR #15614:
URL: https://github.com/apache/grails-core/pull/15614#issuecomment-4357433622

   Pushed 
[`23f586d4f6`](https://github.com/apache/grails-core/pull/15614/commits/23f586d4f6)
 addressing @jdaugherty's review.
   
   ## What changed
   
   Moved the shadow jar SBOM wiring **out of** the generic `SbomPlugin` and 
**into** `grails-forge/grails-cli/build.gradle`, the only project that actually 
combines `com.gradleup.shadow` with `org.apache.grails.buildsrc.sbom`.
   
   * `SbomPlugin` lost `publishSbomForShadowJarProjects` and the raw `Task -> 
Jar` cast it required, plus the now-unused `import org.gradle.api.Task`. The 
plugin's only responsibility is back to wiring `cyclonedxDirectBom` into the 
regular `jar` via `publishSbomForJarProjects`.
   * `grails-cli/build.gradle` now uses a typed 
`TaskProvider<CyclonedxDirectTask>` and `cyclonedxDirectBomTask.flatMap { 
it.jsonOutput }` inside the existing `shadowJarTask.configure { ShadowJar it -> 
... }` block. `ShadowJar`, `CyclonedxDirectTask`, `CopySpec`, and `Manifest` 
are all on the buildscript classpath at that point, so the wiring is fully 
type-safe with no compile dep added to `build-logic`.
   * `skipJavaComponent` guard preserved to match the convention used by 
`publishSbomForJarProjects`.
   * `:grails-cli-shadow/build.gradle` is unchanged - it already excludes 
`META-INF/sbom.json` directly because it doesn't apply the SBOM plugin.
   
   ## Verification (Gradle 9.4.1, `--rerun-tasks`)
   
   | Jar | `serialNumber` | `metadata.component.name` |
   |---|---|---|
   | `:grails-cli` (regular) | `urn:uuid:beabd2c0-...` | `grails-cli` |
   | `:grails-cli` (`-all` FAT) | `urn:uuid:beabd2c0-...` | `grails-cli` |
   | `:grails-cli-shadow` (`-all` FAT) | _(no SBOM - excluded)_ | _(no SBOM)_ |
   | `:grails-forge-cli` (regular) | `urn:uuid:401e573c-...` | 
`grails-forge-cli` |
   
   * `:grails-cli`'s regular and `-all` jar share a `serialNumber` by design 
(same project).
   * The fat jar's `metadata.component.name` is `grails-cli` (not the leaked 
`grails-shell-cli` from before the fix).
   * `:grails-cli-shadow` correctly has no `META-INF/sbom.json` in its fat jar.
   * `:grails-forge-cli` has a distinct `serialNumber` describing the right 
module.
   
   Replied to both review threads inline.


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: [email protected]

For queries about this service, please contact Infrastructure at:
[email protected]

Reply via email to