The GitHub Actions job "Coverage" on grails-core.git/chore/automate-project-conventions has failed. Run started by GitHub user jamesfredley (triggered by jamesfredley).
Head commit for run: 7a0aceb5ff226125049d933e60ac70a83c67754c / James Fredley <[email protected]> Address review feedback on repository conventions automation Action pinning is reverted to project policy: SHA-pin third-party actions only. The GitHub-official actions/* namespace and the project's own apache/grails-github-actions go back to version and branch references, so gradle.yml, vulnerability-scan.yml, release-close.yml and release-publish-docs.yml return to a zero diff against 8.0.x, undoing an unintended actions/setup-java v4 to v5 major-version crossing inside two release reproducibility pins. RepositoryConventionsTask now exempts those two owner namespaces from the 40-hex rule and from the cross-file SHA consistency check, while still requiring a non-empty ref. The AGENTS.md skill index is no longer required. The validator only rejects a skill path AGENTS.md references that does not exist, so both an explicit index and the directory-based discovery proposed in #15977 pass. PMD and SpotBugs enablement moves from a hardcoded list in gradle.properties to a per-project grailsCodeAnalysis extension opt-in, with the -P properties kept as overrides. The root aggregator derives the enabled set from applied plugins instead of a list. Aggregation restores configuration avoidance with configureEach and collection-based dependsOn and mustRunAfter, drops the cleanup dependency that erased every module's reports and defeated up-to-date checks, uses a realization-free rat lookup ordered with mustRunAfter, and removes the dead ignoreFailures input and the redundant style-to-conventions edge. Aggregate reports gained a Modules analyzed header, and the analyzer finalizers are gone so only the aggregate lane writes the Markdown and a partial run can no longer replace an authoritative report with stale marker data. Because the conventions gate was consequently unreachable from CI, the codestyle core job now invokes validateRepositoryConventions explicitly. Validator correctness: UTF-8 on every read and the report write, BOM stripping, specific front-matter diagnostics instead of phantom missing-key violations, an explicit skill directory-name violation, reported malformed properties lines, a single canonical repository root, and an explanatory rejection for non-literal container images. Message-key scanning widens to grails-app/i18n/**/*.properties and the build-output excludes are anchored to each project's configured build directory. Release provenance is corrected: the agent files are tracked symlinks to AGENTS.md and .agents/skills, so they ship in the source zip again, RAT exclusions narrow to what genuinely cannot carry a header, .asf.yaml is excluded to match its comment, and symlink timestamps are normalized with touch -h. .worktrees/ becomes the documented standard worktree location. SnakeYAML moves to a managed snakeyamlVersion property at 2.6. Test coverage grows from 77 to 85, adding SpotBugs and Checkstyle end-to-end paths, the style-side missing report, aggregate report immutability under a direct analyzer run, CI wiring in both directions, and the new validator branches. Fixtures take tool versions from the root gradle.properties instead of hardcoded literals. Assisted-by: claude-code:claude-5-opus Report URL: https://github.com/apache/grails-core/actions/runs/30483964254 With regards, GitHub Actions via GitBox
