jamesfredley commented on code in PR #15614:
URL: https://github.com/apache/grails-core/pull/15614#discussion_r3176545865
##########
grails-forge/grails-cli-shadow/build.gradle:
##########
@@ -77,6 +77,12 @@ shadowJarTask.configure { ShadowJar it ->
it.exclude(
'META-INF/DEPENDENCIES', // until we publish our own SBOM, this
won't be correct so exclude
+ // This module does not apply org.apache.grails.buildsrc.sbom
(it's an intermediate build
+ // artifact, not published). Without this exclude, shadow's
first-wins merge picks one of
Review Comment:
Done in 1144b74e8a - shortened to a single inline note on the exclude line:
`'META-INF/sbom.json', // intermediate build, exclude conflicting files`
##########
grails-forge/grails-cli/build.gradle:
##########
@@ -122,8 +133,27 @@ shadowJarTask.configure { ShadowJar it ->
'META-INF/DEPENDENCIES', // until we publish our own SBOM, this
won't be correct so exclude
'META-INF/grails-plugin.xml', // we do not start or compile a
grails application so these files are not needed (grails-core, url mappings,
etc plugins)
'META-INF/grails-plugin.xml.asc', // avoid signing artifacts
+ // Drop any incoming sbom.json that arrives via transitive jars
during the shadow merge;
+ // re-introduced below from this project's own cyclonedxDirectBom
output.
+ 'META-INF/sbom.json',
'about.html' // restatement of the Eclipse Distribution License -
Version 1.0 for jakarta
)
+
+ // Re-introduce this project's own SBOM after the merge (mirrors the
regular jar wiring done by
+ // the org.apache.grails.buildsrc.sbom plugin). Mirrored only when
skipJavaComponent is unset to
+ // match the convention used elsewhere in the build for projects that opt
out of jar publication.
+ if (!project.findProperty('skipJavaComponent')) {
+ it.from(cyclonedxDirectBomTask.flatMap { CyclonedxDirectTask t ->
t.jsonOutput }) { CopySpec spec ->
Review Comment:
Done in 1144b74e8a - swapped to passing the task provider directly:
`it.from(cyclonedxDirectBomTask) { CopySpec spec -> spec.into('META-INF');
spec.rename { 'sbom.json' } }`
Verified `BaseCyclonedxTask` declares two `@OutputFile @Optional
RegularFileProperty` outputs (`getJsonOutput` / `getXmlOutput`), but
`SbomPlugin.configureSbomTask` calls `xmlOutput.unsetConvention()` and only
ever sets `jsonOutput`, so at execution time `jsonOutput` is the only effective
output.
(Minor nit on the original phrasing: `flatMap` on a `Provider` is lazy in
the Provider API sense - it returns a `Provider<T>` that is only evaluated when
needed - but you are right that since there is only one effective output here,
the direct task reference is simpler and reads better. Same byte-identical SBOM
as before: `urn:uuid:beabd2c0-0175-3997-bae5-bb8dd245f97b` for `:grails-cli`
regular and -all jar.)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
