The GitHub Actions job "Licensing - RAT Report" on grails-core.git/fix/sbom-uuid-collision-gradle-9 has succeeded. Run started by GitHub user jamesfredley (triggered by jamesfredley).
Head commit for run: 1144b74e8acf8b0086e5241ff0ab57b8a84e055a / James Fredley <[email protected]> fix(sbom): address jdaugherty review feedback - Restore the original one-line comment in SbomPlugin#apply; the shadow-jar wiring lives entirely in grails-cli/build.gradle now, so the verbose explanation in the generic plugin is unnecessary. - Drop the long block comment in grails-cli-shadow/build.gradle and inline a short note next to the META-INF/sbom.json exclude. - In grails-cli/build.gradle, move the cyclonedxDirectBomTask lookup into the shadowJar configure block (its only caller), pass the task provider directly to from(...) instead of flatMap { it.jsonOutput } (jsonOutput is the only effective output because SbomPlugin calls xmlOutput.unsetConvention()), and shorten the comment. Verified on Gradle 9.4.1 with --rerun-tasks twice: - :grails-cli (regular jar) urn:uuid:beabd2c0-... / grails-cli - :grails-cli (-all FAT) urn:uuid:beabd2c0-... / grails-cli - :grails-cli-shadow (-all) no META-INF/sbom.json (excluded) - Sbom-Location / Sbom-Format manifest entries present on the fat jar - :grails-bootstrap urn:uuid:3fe6e19d-... matches PR description, so end-to-end reproducibility across the whole build is preserved. Assisted-by: claude-code:claude-4.6-opus Report URL: https://github.com/apache/grails-core/actions/runs/25250664664 With regards, GitHub Actions via GitBox
