The GitHub Actions job "CI - Groovy Joint Validation Build" on grails-core.git/fix/sbom-uuid-collision-gradle-9 has failed. Run started by GitHub user jamesfredley (triggered by jamesfredley).
Head commit for run: 23f586d4f6b363ebe889ea4225d1f45df2eed861 / James Fredley <[email protected]> fix(sbom): move shadow jar SBOM wiring into grails-cli build.gradle Per review feedback on PR #15614, configure the fat-jar SBOM logic directly in the project that uses com.gradleup.shadow rather than adding a shadow-aware hook to the generic SbomPlugin convention plugin. * Remove publishSbomForShadowJarProjects from SbomPlugin and the raw Task -> Jar cast it required. The plugin no longer needs to know about com.gradleup.shadow at all; its only responsibility is wiring cyclonedxDirectBom into the regular jar via publishSbomForJarProjects. * Wire the same exclude / from / manifest logic into the existing shadowJarTask.configure block in grails-forge/grails-cli/build.gradle, using a typed TaskProvider<CyclonedxDirectTask> and cyclonedxDirectBomTask.flatMap { it.jsonOutput } so the shadow jar picks up only the post-processed sbom.json output (and not any future task outputs). The skipJavaComponent guard is preserved to match the convention used by publishSbomForJarProjects. * :grails-cli-shadow/build.gradle is unchanged; it already excludes META-INF/sbom.json directly because that module does not apply org.apache.grails.buildsrc.sbom. Verified on Gradle 9.4.1 with --rerun-tasks: the regular and fat :grails-cli jars share a serialNumber (by design, same project), the fat jar's metadata.component.name is grails-cli (not the leaked grails-shell-cli), and :grails-forge-cli has a distinct serialNumber. :grails-cli-shadow's fat jar correctly contains no META-INF/sbom.json. Assisted-by: claude-code:claude-opus-4 Report URL: https://github.com/apache/grails-core/actions/runs/25199130641 With regards, GitHub Actions via GitBox
