build.gradle

/*
 *  Licensed to the Apache Software Foundation (ASF) under one
 *  or more contributor license agreements.  See the NOTICE file
 *  distributed with this work for additional information
 *  regarding copyright ownership.  The ASF licenses this file
 *  to you under the Apache License, Version 2.0 (the
 *  "License"); you may not use this file except in compliance
 *  with the License.  You may obtain a copy of the License at
 *
 *    https://www.apache.org/licenses/LICENSE-2.0
 *
 *  Unless required by applicable law or agreed to in writing,
 *  software distributed under the License is distributed on an
 *  "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
 *  KIND, either express or implied.  See the License for the
 *  specific language governing permissions and limitations
 *  under the License.
 */

// This Grails application is regression coverage for the legacy Spring Dependency
// Management Gradle plugin (io.spring.dependency-management). Grails 8 no longer
// applies that plugin automatically - dependency versions are managed by Gradle's
// native platform() support via the Grails Gradle plugin. However, an existing
// Grails 7 application that applied io.spring.dependency-management by hand must
// continue to work. This example reproduces that scenario:
//
//   * grails { bom = null } opts out of the Grails Gradle plugin's automatic
//     platform(grails-bom) injection, so version management is NOT provided by the
//     framework's native platform.
//   * io.spring.dependency-management is applied directly and imports grails-bom as
//     a Maven BOM, exactly as a migrated Grails 7 build would, so that the Spring DM
//     plugin is the source of truth for managed versions here.
//
// It is an end-to-end test because a Maven BOM import is only satisfiable by a real
// published pom - see the note on the include in settings.gradle.
plugins {
    id 'groovy'
    id 'org.apache.grails.buildsrc.properties'
    id 'org.apache.grails.buildsrc.compile'
    id 'org.apache.grails.buildsrc.vulnerability-scan'
    id 'org.apache.grails.gradle.grails-web'
    id 'org.apache.grails.gradle.grails-gsp'
}

version = '0.1'
group = 'springdm'

// io.spring.dependency-management arrives on the build classpath transitively, through the Grails
// Gradle plugin's dependency on spring-boot-gradle-plugin, so it is applied here without a version
// (an explicit version in the plugins {} block fails when a plugin is already on the classpath with
// an unknown version). A real end-user Grails build would instead declare it in its own plugins {}
// block with a version.
apply plugin: 'io.spring.dependency-management'

grails {
    // Opt out of the native platform(grails-bom) injection; Spring DM manages versions instead.
    bom = null
}

dependencyManagement {
    imports {
        // Resolved by Spring DM's own detached configuration, so it is a genuine Maven BOM import
        // of the pom the core build published into build/local-maven - not a substituted project.
        mavenBom "org.apache.grails:grails-bom:${projectVersion}"
    }
}

// io.spring.dependency-management lets spring-boot-dependencies' own logback.version property win over
// the grails-bom import, so the security-patched logback isn't applied automatically. A migrated Grails 7
// app hitting the same CVE would override the Spring-managed version property directly; reproduce that here,
// sourcing the number from dependencies.gradle so it stays the single source of truth.
apply from: rootProject.layout.projectDirectory.file('../dependencies.gradle')
// Spring DM lets spring-boot-dependencies' Groovy property override the Grails BOM import.
// Keep the canary runtime aligned with the Groovy version used to compile the framework.
ext['groovy.version'] = bomDependencyVersions['groovy.version']
ext['logback.version'] = bomDependencyVersions['logback.version']
// Same situation for the Jackson 3 security override (CVE-2026-59889) - see jackson3.version in dependencies.gradle.
ext['jackson-bom.version'] = bomDependencyVersions['jackson3.version']

dependencies {
    implementation 'org.apache.grails:grails-dependencies-starter-web'
    implementation 'org.apache.grails:grails-data-hibernate5'
    implementation 'org.apache.grails:grails-layout'

    runtimeOnly 'com.h2database:h2'
    runtimeOnly 'org.apache.tomcat:tomcat-jdbc'

    testImplementation 'org.apache.grails:grails-testing-support-web'

    integrationTestImplementation 'org.apache.grails:grails-testing-support-http-client'
}

// The core build's gradle/functional-test-config.gradle is deliberately not applied here, for the
// same reasons as in legacy-commands: its dependency substitution enumerates
// rootProject.subprojects, which only makes sense inside the core build - and substituting
// projects is the very thing this project must not do, since the point is to import a published
// grails-bom pom. Its remaining job, the per-suite skip flags keyed off grails-test-examples-*
// project names, has no meaning in this build, which is driven by its own workflow.
apply {
    from rootProject.layout.projectDirectory.file('gradle/test-config.gradle')
}

tasks.withType(Test).configureEach {
    // Allow extra headroom for slow start-up under CI load (the client default is 60s), matching
    // what gradle/functional-test-config.gradle gave this application in the core build.
    systemProperty('grails.http.client.timeout', '120')
}