gradle.yml

# Licensed to the Apache Software Foundation (ASF) under one or more
# contributor license agreements.  See the NOTICE file distributed with
# this work for additional information regarding copyright ownership.
# The ASF licenses this file to You under the Apache License, Version 2.0
# (the "License"); you may not use this file except in compliance with
# the License.  You may obtain a copy of the License at
#
#     https://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.

name: "CI"
on:
  push:
    branches:
      - '[0-9]+.[0-9]+.x'
  pull_request:
  workflow_dispatch:
# Queue jobs - cancel in-progress PR runs when new commits pushed, but allow branch builds to complete
concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
jobs:
  validateDependencies:
    name: 'Validate Dependency Versions'
    runs-on: ubuntu-24.04
    steps:
      - name: "📥 Checkout repository"
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
      - name: "☕️ Setup JDK"
        uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
        with:
          distribution: liberica
          java-version: 21
      - name: "🗄️ Restore dependency jar cache"
        uses: actions/cache@v4
        with:
          # Cache only downloaded dependency jars and wrapper distributions, never Grails build outputs.
          # Keyed by branch version so each release branch maintains its own warm cache.
          path: |
            ~/.gradle/caches/modules-2
            ~/.gradle/wrapper
          key: gradle-deps-${{ runner.os }}-${{ github.base_ref || github.ref_name }}-${{ hashFiles('**/dependencies.gradle', '**/gradle-wrapper.properties') }}
          restore-keys: |
            gradle-deps-${{ runner.os }}-${{ github.base_ref || github.ref_name }}-
      - name: "🐘 Setup Gradle"
        uses: gradle/actions/setup-gradle@50e97c2cd7a37755bbfafc9c5b7cafaece252f6e # v6.1.0
        with:
          cache-provider: basic # 'basic' uses the MIT-licensed, open-source cache provider; the default 'enhanced' provider (v6+) is proprietary (Gradle commercial Terms of Use)
          develocity-access-key: ${{ secrets.DEVELOCITY_ACCESS_KEY  }}
      - name: "🔍 Validate grails-core dependency versions"
        run: >
          ./gradlew validateDependencyVersions
          --continue
          --stacktrace
      - name: "🔍 Validate grails-core production classpath"
        run: >
          ./gradlew validateProductionClasspath
          --continue
          --stacktrace
      - name: "🔍 Validate grails-gradle dependency versions"
        working-directory: 'grails-gradle'
        run: >
          ./gradlew validateDependencyVersions
          --continue
          --stacktrace
  buildGradle:
    name: 'Build Gradle Plugins'
    strategy:
      fail-fast: false
      matrix:
        java: [ 21, 25 ]
    runs-on: ubuntu-24.04
    steps:
      - name: "Output Agent IP" # in the event RAO blocks this agent, this can be used to debug it
        run: curl -s https://api.ipify.org
      - name: "📥 Checkout repository"
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
      - name: "☕️ Setup JDK"
        uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
        with:
          distribution: liberica
          java-version: ${{ matrix.java }}
      - name: "🗄️ Restore dependency jar cache"
        uses: actions/cache@v4
        with:
          # Cache only downloaded dependency jars and wrapper distributions, never Grails build outputs.
          # Keyed by branch version so each release branch maintains its own warm cache.
          path: |
            ~/.gradle/caches/modules-2
            ~/.gradle/wrapper
          key: gradle-deps-${{ runner.os }}-${{ github.base_ref || github.ref_name }}-${{ hashFiles('**/dependencies.gradle', '**/gradle-wrapper.properties') }}
          restore-keys: |
            gradle-deps-${{ runner.os }}-${{ github.base_ref || github.ref_name }}-
      - name: "🐘 Setup Gradle"
        uses: gradle/actions/setup-gradle@50e97c2cd7a37755bbfafc9c5b7cafaece252f6e # v6.1.0
        with:
          cache-disabled: true # dependency jars are cached by the explicit branch-keyed step above
          develocity-access-key: ${{ secrets.DEVELOCITY_ACCESS_KEY  }}
      - name: "🔍 Setup TestLens"
        uses: testlens-app/setup-testlens@3f82d2dc6cd5c03f02ce5f7885a21195d85f8d14 # v1.9.3
      - name: "🔨 Build project without tests"
        if: ${{ contains(github.event.head_commit.message, '[skip tests]') }}
        working-directory: 'grails-gradle'
        run: >
          ./gradlew build
          --continue
          --stacktrace
          -PskipCodeStyle
          -PskipTests
      - name: "🔨 Build project with tests"
        if: ${{ !contains(github.event.head_commit.message, '[skip tests]') }}
        working-directory: 'grails-gradle'
        run: >
          ./gradlew build
          --continue
          --stacktrace
          --rerun-tasks
          -PskipCodeStyle
  build:
    if: ${{ !contains(github.event.head_commit.message, '[skip tests]') }}
    name: 'Build Grails-Core (${{ matrix.job_name }})'
    strategy:
      fail-fast: false
      matrix:
        include:
          - os: ubuntu-latest
            java: 21
            job_name: Ubuntu JDK 21
            gradle_task: 'build :grails-shell-cli:installDist groovydoc'
            cache_writer: true
          - os: ubuntu-latest
            java: 25
            job_name: Ubuntu JDK 25
            gradle_task: 'build :grails-shell-cli:installDist groovydoc'
            cache_writer: false
          - os: macos-latest
            java: 21
            job_name: macOS JDK 21
            gradle_task: 'build :grails-shell-cli:installDist groovydoc'
            cache_writer: true
          - os: windows-latest
            java: 25
            job_name: Windows JDK 25 shard 0
            gradle_task: 'build :grails-shell-cli:installDist groovydoc'
            shard_arguments: '-PtestShardCount=3 -PtestShardIndex=0'
            cache_writer: true
          - os: windows-latest
            java: 25
            job_name: Windows JDK 25 shard 1
            gradle_task: testShard
            shard_arguments: '-PtestShardCount=3 -PtestShardIndex=1'
            cache_writer: false
          - os: windows-latest
            java: 25
            job_name: Windows JDK 25 shard 2
            gradle_task: testShard
            shard_arguments: '-PtestShardCount=3 -PtestShardIndex=2'
            cache_writer: false
    runs-on: ${{ matrix.os }}
    steps:
      - name: "Output Agent IP" # in the event RAO blocks this agent, this can be used to debug it
        run: curl -s https://api.ipify.org
      - name: "📥 Checkout repository"
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
      - name: "☕️ Setup JDK"
        uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
        with:
          distribution: liberica
          java-version: ${{ matrix.java }}
      - name: "🗄️ Restore dependency jar cache"
        id: dependency-cache
        uses: actions/cache/restore@v4
        with:
          # Cache only downloaded dependency jars and wrapper distributions, never Grails build outputs.
          # Keyed by branch version so each release branch maintains its own warm cache.
          path: |
            ~/.gradle/caches/modules-2
            ~/.gradle/wrapper
          key: gradle-deps-${{ runner.os }}-${{ github.base_ref || github.ref_name }}-${{ hashFiles('**/dependencies.gradle', '**/gradle-wrapper.properties') }}
          restore-keys: |
            gradle-deps-${{ runner.os }}-${{ github.base_ref || github.ref_name }}-
      - name: "🐘 Setup Gradle"
        uses: gradle/actions/setup-gradle@50e97c2cd7a37755bbfafc9c5b7cafaece252f6e # v6.1.0
        with:
          cache-disabled: true # dependency jars are cached by the explicit branch-keyed step above
          develocity-access-key: ${{ secrets.DEVELOCITY_ACCESS_KEY  }}
      - name: "🔍 Setup TestLens"
        uses: testlens-app/setup-testlens@3f82d2dc6cd5c03f02ce5f7885a21195d85f8d14 # v1.9.3
      - name: "🔨 Build project"
        # The Grails-Micronaut "island" (grails-micronaut, grails-micronaut-bom, the
        # micronaut-tied test-examples) is auto-managed by settings.gradle based on the
        # build JDK: it is pruned on a sub-25 JDK (Micronaut 5 GA targets JVM 25 bytecode)
        # and included automatically on JDK 25+. So the Java 21 entries build everything
        # except the island and the Java 25 entries build the full graph - no flag needed.
        run: >
          ./gradlew ${{ matrix.gradle_task }}
          --continue
          --stacktrace
          -PonlyCoreTests
          -PskipCodeStyle
          ${{ matrix.shard_arguments }}
      - name: "🗄️ Save dependency jar cache"
        if: ${{ success() && matrix.cache_writer && steps.dependency-cache.outputs.cache-hit != 'true' }}
        uses: actions/cache/save@v4
        with:
          path: |
            ~/.gradle/caches/modules-2
            ~/.gradle/wrapper
          key: gradle-deps-${{ runner.os }}-${{ github.base_ref || github.ref_name }}-${{ hashFiles('**/dependencies.gradle', '**/gradle-wrapper.properties') }}
  buildRerunTasks:
    if: ${{ !contains(github.event.head_commit.message, '[skip tests]') }}
    name: 'Build Grails-Core Rerunning all Tasks (${{ matrix.job_name }})'
    strategy:
      fail-fast: false
      matrix:
        include:
          - os: ubuntu-latest
            java: 21
            job_name: Ubuntu JDK 21 build
            gradle_task: 'build :grails-shell-cli:installDist groovydoc'
            extra_arguments: '-PskipTests'
            cache_writer: true
          - os: ubuntu-latest
            java: 21
            job_name: Ubuntu JDK 21 shard 0
            gradle_task: testShard
            extra_arguments: '-PtestShardCount=3 -PtestShardIndex=0'
            cache_writer: false
          - os: ubuntu-latest
            java: 21
            job_name: Ubuntu JDK 21 shard 1
            gradle_task: testShard
            extra_arguments: '-PtestShardCount=3 -PtestShardIndex=1'
            cache_writer: false
          - os: ubuntu-latest
            java: 21
            job_name: Ubuntu JDK 21 shard 2
            gradle_task: testShard
            extra_arguments: '-PtestShardCount=3 -PtestShardIndex=2'
            cache_writer: false
    runs-on: ${{ matrix.os }}
    steps:
      - name: "Output Agent IP" # in the event RAO blocks this agent, this can be used to debug it
        run: curl -s https://api.ipify.org
      - name: "📥 Checkout repository"
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
      - name: "☕️ Setup JDK"
        uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
        with:
          distribution: liberica
          java-version: ${{ matrix.java }}
      - name: "🗄️ Restore dependency jar cache"
        id: dependency-cache
        uses: actions/cache/restore@v4
        with:
          # Cache only downloaded dependency jars and wrapper distributions, never Grails build outputs.
          # Keyed by branch version so each release branch maintains its own warm cache.
          path: |
            ~/.gradle/caches/modules-2
            ~/.gradle/wrapper
          key: gradle-deps-${{ runner.os }}-${{ github.base_ref || github.ref_name }}-${{ hashFiles('**/dependencies.gradle', '**/gradle-wrapper.properties') }}
          restore-keys: |
            gradle-deps-${{ runner.os }}-${{ github.base_ref || github.ref_name }}-
      - name: "🐘 Setup Gradle"
        uses: gradle/actions/setup-gradle@50e97c2cd7a37755bbfafc9c5b7cafaece252f6e # v6.1.0
        with:
          cache-disabled: true # dependency jars are cached by the explicit branch-keyed step above
          develocity-access-key: ${{ secrets.DEVELOCITY_ACCESS_KEY  }}
      - name: "🔍 Setup TestLens"
        uses: testlens-app/setup-testlens@3f82d2dc6cd5c03f02ce5f7885a21195d85f8d14 # v1.9.3
      - name: "🔨 Build project"
        # This job only runs on Java 21, where settings.gradle auto-prunes the Micronaut
        # island (Micronaut 5 GA targets JVM 25 bytecode). See comment on `build`.
        run: >
          ./gradlew ${{ matrix.gradle_task }}
          --continue
          --rerun-tasks
          --stacktrace
          -PonlyCoreTests
          -PskipCodeStyle
          ${{ matrix.extra_arguments }}
      - name: "🗄️ Save dependency jar cache"
        if: ${{ success() && matrix.cache_writer && steps.dependency-cache.outputs.cache-hit != 'true' }}
        uses: actions/cache/save@v4
        with:
          path: |
            ~/.gradle/caches/modules-2
            ~/.gradle/wrapper
          key: gradle-deps-${{ runner.os }}-${{ github.base_ref || github.ref_name }}-${{ hashFiles('**/dependencies.gradle', '**/gradle-wrapper.properties') }}
  buildForge:
    name: "Build Grails Forge (Java ${{ matrix.java }}, indy=${{ matrix.indy }})"
    strategy:
      fail-fast: false
      matrix:
        java: [ 21, 25 ]
        indy: [ false ]
        include:
          - java: 21
            indy: true
    runs-on: ubuntu-24.04
    steps:
      - name: "Output Agent IP" # in the event RAO blocks this agent, this can be used to debug it
        run: curl -s https://api.ipify.org
      - name: "📥 Checkout repository"
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
      - name: "☕️ Setup JDK"
        uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
        with:
          distribution: 'liberica'
          java-version: ${{ matrix.java }}
      - name: "🗄️ Restore dependency jar cache"
        uses: actions/cache@v4
        with:
          # Cache only downloaded dependency jars and wrapper distributions, never Grails build outputs.
          # Keyed by branch version so each release branch maintains its own warm cache.
          path: |
            ~/.gradle/caches/modules-2
            ~/.gradle/wrapper
          key: gradle-deps-${{ runner.os }}-${{ github.base_ref || github.ref_name }}-${{ hashFiles('**/dependencies.gradle', '**/gradle-wrapper.properties') }}
          restore-keys: |
            gradle-deps-${{ runner.os }}-${{ github.base_ref || github.ref_name }}-
      - name: "🐘 Setup Gradle"
        uses: gradle/actions/setup-gradle@50e97c2cd7a37755bbfafc9c5b7cafaece252f6e # v6.1.0
        with:
          cache-disabled: true # dependency jars are cached by the explicit branch-keyed step above
          develocity-access-key: ${{ secrets.DEVELOCITY_ACCESS_KEY  }}
      - name: "🔍 Setup TestLens"
        uses: testlens-app/setup-testlens@3f82d2dc6cd5c03f02ce5f7885a21195d85f8d14 # v1.9.3
      - name: "🔨 Build project without tests"
        if: ${{ contains(github.event.head_commit.message, '[skip tests]') }}
        working-directory: 'grails-forge'
        # The Forge composite build includes the root grails-core via
        # `includeBuild('..')` in grails-forge/settings.gradle. On Java 21 that
        # included build auto-prunes the Micronaut island (settings.gradle), so the
        # Forge build never tries to compile the JVM-25 island; Java 25 includes it.
        run: >
          ./gradlew build
          --continue
          --stacktrace
          -PgrailsIndy=${{ matrix.indy }}
          -PskipCodeStyle
          -PskipTests
      - name: "🔨 Build project with tests"
        if: ${{ !contains(github.event.head_commit.message, '[skip tests]') }}
        working-directory: 'grails-forge'
        # See comment above on the auto-managed Micronaut island.
        run: >
          ./gradlew build
          --continue
          --rerun-tasks
          --stacktrace
          -PgrailsIndy=${{ matrix.indy }}
          -PskipCodeStyle
      - name: "✅ Verify combined CLI"
        run: |
          cd grails-forge
          cp grails-cli/build/distributions/apache-grails-*.zip cli.zip
          unzip cli -d tmp1
          mv tmp1/apache-grails-* tmp1/cli
          ./tmp1/cli/bin/grails --version
          ./tmp1/cli/bin/grails-forge-cli --version
      - name: "📤 Upload CLI Zip to Workflow Summary Page"
        if: ${{ matrix.java == '21' && matrix.indy == false }}
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: 'apache-grails-SNAPSHOT-bin.zip'
          include-hidden-files: true
          path: grails-forge/tmp1/cli/**/*
          if-no-files-found: 'error'
  functional:
    name: "Functional Tests (${{ matrix.job_name }})"
    if: ${{ !contains(github.event.head_commit.message, '[skip tests]') }}
    # 8.0.x history: shard 1 is 22-34 min, indy=true shard 0 is 48-55.
    # On Groovy 6, shard 1 tests finish around 31 min then Gradle hangs in
    # worker teardown. The init script exits after buildFinished so that hang
    # cannot occupy a runner. This job cap is a last-resort backstop.
    timeout-minutes: 80
    strategy:
      fail-fast: false
      matrix:
        include:
          - java: 21
            indy: false
            job_name: Java 21, indy=false
            gradle_task: 'bootJar check'
            artifact_suffix: java21-indyfalse-shard0
            cache_writer: true
            shard_arguments: '-PtestShardCount=2 -PtestShardIndex=0'
          - java: 21
            indy: false
            job_name: Java 21, indy=false, shard 1
            gradle_task: testShard
            artifact_suffix: java21-indyfalse-shard1
            cache_writer: false
            shard_arguments: '-PtestShardCount=2 -PtestShardIndex=1'
          - java: 21
            indy: true
            job_name: Java 21, indy=true
            gradle_task: 'bootJar check'
            artifact_suffix: java21-indytrue-shard0
            cache_writer: false
            shard_arguments: '-PtestShardCount=2 -PtestShardIndex=0'
          - java: 21
            indy: true
            job_name: Java 21, indy=true, shard 1
            gradle_task: testShard
            artifact_suffix: java21-indytrue-shard1
            cache_writer: false
            shard_arguments: '-PtestShardCount=2 -PtestShardIndex=1'
          - java: 25
            indy: false
            job_name: Java 25, indy=false
            gradle_task: 'bootJar check'
            artifact_suffix: java25-indyfalse-shard0
            cache_writer: false
            shard_arguments: '-PtestShardCount=2 -PtestShardIndex=0'
          - java: 25
            indy: false
            job_name: Java 25, indy=false, shard 1
            gradle_task: testShard
            artifact_suffix: java25-indyfalse-shard1
            cache_writer: false
            shard_arguments: '-PtestShardCount=2 -PtestShardIndex=1'
    runs-on: ubuntu-24.04
    steps:
      - name: "Output Agent IP" # in the event RAO blocks this agent, this can be used to debug it
        run: curl -s https://api.ipify.org
      - name: "📥 Checkout repository"
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
      - name: "☕️ Setup JDK"
        uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
        with:
          distribution: liberica
          java-version: ${{ matrix.java }}
      - name: "🗄️ Restore dependency jar cache"
        id: dependency-cache
        uses: actions/cache/restore@v4
        with:
          # Cache only downloaded dependency jars and wrapper distributions, never Grails build outputs.
          # Keyed by branch version so each release branch maintains its own warm cache.
          path: |
            ~/.gradle/caches/modules-2
            ~/.gradle/wrapper
          key: gradle-deps-${{ runner.os }}-${{ github.base_ref || github.ref_name }}-${{ hashFiles('**/dependencies.gradle', '**/gradle-wrapper.properties') }}
          restore-keys: |
            gradle-deps-${{ runner.os }}-${{ github.base_ref || github.ref_name }}-
      - name: "🐘 Setup Gradle"
        uses: gradle/actions/setup-gradle@50e97c2cd7a37755bbfafc9c5b7cafaece252f6e # v6.1.0
        with:
          cache-disabled: true # dependency jars are cached by the explicit branch-keyed step above
          develocity-access-key: ${{ secrets.DEVELOCITY_ACCESS_KEY  }}
      - name: "🔍 Setup TestLens"
        uses: testlens-app/setup-testlens@3f82d2dc6cd5c03f02ce5f7885a21195d85f8d14 # v1.9.3
      - name: "🏃 Run Functional Tests"
        # The Micronaut island is auto-pruned on a sub-25 JDK (settings.gradle), so the
        # Java 21 entries skip it and the Java 25 entries include it (see comment on `build`).
        # The known hanging cell finishes tests, prints the wrapper:test /
        # aggregate-report tail, then hangs before buildFinished. Timeout plus
        # that end-of-walk log and green XML is treated as success.
        run: |
          hanging=0
          if [ "${{ matrix.java }}" = "21" ] && [ "${{ matrix.indy }}" = "true" ] && [ "${{ matrix.gradle_task }}" = "testShard" ]; then
            hanging=1
            limit=45m
          else
            limit=70m
          fi
          rm -f build/ci-build-finished.txt build/ci-build-finished.txt.tmp
          set +e
          timeout --kill-after=30s "$limit" ./gradlew ${{ matrix.gradle_task }} \
            --init-script .github/ci-exit-after-build.init.gradle \
            --no-daemon \
            --continue \
            --rerun-tasks \
            --stacktrace \
            -PgrailsIndy=${{ matrix.indy }} \
            -PonlyFunctionalTests \
            -PskipCodeStyle \
            -PskipHibernate5Tests \
            -PskipHibernate7Tests \
            -PskipMongodbTests \
            -PskipSpringSecurityTests \
            -PskipRedisTests \
            ${{ matrix.shard_arguments }} \
            2>&1 | tee gradle-functional.log
          code=${PIPESTATUS[0]}
          set -e
          if [ "$code" -eq 0 ]; then
            exit 0
          fi
          marker="build/ci-build-finished.txt"
          if [ "$hanging" -eq 1 ] && { [ "$code" -eq 124 ] || [ "$code" -eq 137 ]; }; then
            if [ -f "$marker" ] && [ "$(cat "$marker")" = "SUCCESS" ]; then
              echo "Known hanging cell: SUCCESS sentinel after teardown hang."
              exit 0
            fi
            if grep -qE '> Task .+ FAILED' gradle-functional.log; then
              echo "A Gradle task FAILED; not recovering from teardown hang."
              exit 1
            fi
            if grep -q '> Task :grails-wrapper:test' gradle-functional.log \
              && grep -q 'Markdown aggregate test report:' gradle-functional.log \
              && python3 .github/ci-check-functional-reports.py; then
              echo "Known hanging cell: suite walked to grails-wrapper:test with green XML; teardown hang treated as success."
              exit 0
            fi
          fi
          exit "$code"
      - name: "🗄️ Save dependency jar cache"
        if: ${{ success() && matrix.cache_writer && steps.dependency-cache.outputs.cache-hit != 'true' }}
        uses: actions/cache/save@v4
        with:
          path: |
            ~/.gradle/caches/modules-2
            ~/.gradle/wrapper
          key: gradle-deps-${{ runner.os }}-${{ github.base_ref || github.ref_name }}-${{ hashFiles('**/dependencies.gradle', '**/gradle-wrapper.properties') }}
      - name: "📤 Upload Geb Reports"
        if: failure()
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: geb-reports-functional-${{ matrix.artifact_suffix }}
          path: '**/build/geb-reports/'
          if-no-files-found: ignore
  security:
    name: "Spring Security Tests (${{ matrix.job_name }})"
    if: ${{ !contains(github.event.head_commit.message, '[skip tests]') }}
    strategy:
      fail-fast: false
      matrix:
        include:
          - java: 21
            job_name: Java 21
            gradle_task: 'bootJar check'
          - java: 25
            job_name: Java 25
            gradle_task: 'bootJar check'
            shard_arguments: '-PtestShardCount=2 -PtestShardIndex=0'
          - java: 25
            job_name: Java 25, shard 1
            gradle_task: testShard
            shard_arguments: '-PtestShardCount=2 -PtestShardIndex=1'
    runs-on: ubuntu-24.04
    steps:
      - name: "Output Agent IP" # in the event RAO blocks this agent, this can be used to debug it
        run: curl -s https://api.ipify.org
      - name: "📥 Checkout repository"
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
      - name: "☕️ Setup JDK"
        uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
        with:
          distribution: liberica
          java-version: ${{ matrix.java }}
      - name: "🐘 Setup Gradle"
        uses: gradle/actions/setup-gradle@50e97c2cd7a37755bbfafc9c5b7cafaece252f6e # v6.1.0
        with:
          cache-provider: basic # 'basic' uses the MIT-licensed, open-source cache provider; the default 'enhanced' provider (v6+) is proprietary (Gradle commercial Terms of Use)
          develocity-access-key: ${{ secrets.DEVELOCITY_ACCESS_KEY  }}
      - name: "🔍 Setup TestLens"
        uses: testlens-app/setup-testlens@3f82d2dc6cd5c03f02ce5f7885a21195d85f8d14 # v1.9.3
      - name: "🏃 Run Functional Tests"
        run: >
          ./gradlew ${{ matrix.gradle_task }}
          --continue
          --rerun-tasks
          --stacktrace
          -PonlySpringSecurityTests
          -PskipCodeStyle
          ${{ matrix.shard_arguments }}
  securityConfig:
    name: "Spring Security Config Functional Tests"
    if: ${{ !contains(github.event.head_commit.message, '[skip tests]') }}
    strategy:
      fail-fast: false
      matrix:
        # Each value boots the core functional-test-app with a different Spring Security configuration.
        # The specs are gated with @IgnoreIf({ System.getProperty('TESTCONFIG') != '<config>' }), so a
        # config only runs when TESTCONFIG matches. TESTCONFIG is applied at app startup, so every config
        # must be its own run. Carried over from the standalone grails-spring-security CI — do not drop
        # configs (add, don't remove) when the app's security configurations change.
        test-config: [ 'static', 'annotation', 'requestmap', 'basic', 'basicCacheUsers', 'misc', 'putWithParams', 'bcrypt', 'issue503' ]
    runs-on: ubuntu-24.04
    steps:
      - name: "Output Agent IP" # in the event RAO blocks this agent, this can be used to debug it
        run: curl -s https://api.ipify.org
      - name: "📥 Checkout repository"
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
      - name: "☕️ Setup JDK"
        uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
        with:
          distribution: liberica
          java-version: 21
      - name: "🐘 Setup Gradle"
        uses: gradle/actions/setup-gradle@50e97c2cd7a37755bbfafc9c5b7cafaece252f6e # v6.1.0
        with:
          cache-provider: basic # 'basic' uses the MIT-licensed, open-source cache provider; the default 'enhanced' provider (v6+) is proprietary (Gradle commercial Terms of Use)
          develocity-access-key: ${{ secrets.DEVELOCITY_ACCESS_KEY  }}
      - name: "🔍 Setup TestLens"
        uses: testlens-app/setup-testlens@3f82d2dc6cd5c03f02ce5f7885a21195d85f8d14 # v1.9.3
      - name: "🏃 Run Spring Security Functional Tests (TESTCONFIG=${{ matrix.test-config }})"
        run: >
          ./gradlew
          :grails-test-examples-spring-security-core-functional-test-app:check
          --continue
          --rerun-tasks
          --stacktrace
          -DTESTCONFIG=${{ matrix.test-config }}
          -PskipCodeStyle
  redis:
    name: "Redis Tests"
    if: ${{ !contains(github.event.head_commit.message, '[skip tests]') }}
    runs-on: ubuntu-24.04
    strategy:
      fail-fast: false
      matrix:
        java: [ 21, 25 ]
        redis-version: [ '7.4', '8.0' ] # Redis container version exercised via Testcontainers
    steps:
      - name: "Output Agent IP" # in the event RAO blocks this agent, this can be used to debug it
        run: curl -s https://api.ipify.org
      - name: "📥 Checkout repository"
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
      - name: "☕️ Setup JDK"
        uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
        with:
          distribution: liberica
          java-version: ${{ matrix.java }}
      - name: "🐘 Setup Gradle"
        uses: gradle/actions/setup-gradle@50e97c2cd7a37755bbfafc9c5b7cafaece252f6e # v6.1.0
        with:
          cache-provider: basic # 'basic' uses the MIT-licensed, open-source cache provider; the default 'enhanced' provider (v6+) is proprietary (Gradle commercial Terms of Use)
          develocity-access-key: ${{ secrets.DEVELOCITY_ACCESS_KEY  }}
      - name: "🔍 Setup TestLens"
        uses: testlens-app/setup-testlens@3f82d2dc6cd5c03f02ce5f7885a21195d85f8d14 # v1.9.3
      - name: "🏃 Run Redis Tests"
        run: >
          ./gradlew bootJar check
          --continue
          --rerun-tasks
          --stacktrace
          -PonlyRedisTests
          -PredisContainerVersion=${{ matrix.redis-version }}
          -PskipCodeStyle
  mongodbFunctional:
    if: ${{ !contains(github.event.head_commit.message, '[skip tests]') }}
    name: "Mongodb Functional Tests (Java ${{ matrix.java }}, MongoDB ${{ matrix.mongodb-version }}, indy=${{ matrix.indy }})"
    runs-on: ubuntu-24.04
    strategy:
      fail-fast: false
      matrix:
        java: [ 21, 25 ]
        mongodb-version: [ '7.0', '8.0' ] # test with supported versions https://www.mongodb.com/legal/support-policy/lifecycles
        indy: [ false ]
        include:
          - java: 21
            mongodb-version: '7.0'
            indy: true
    steps:
      - name: "Output Agent IP" # in the event RAO blocks this agent, this can be used to debug it
        run: curl -s https://api.ipify.org
      - name: "📥 Checkout the repository"
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
      - name: "☕️ Setup JDK"
        uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
        with:
          distribution: liberica
          java-version: ${{ matrix.java }}
      - name: "🗄️ Restore dependency jar cache"
        uses: actions/cache@v4
        with:
          # Cache only downloaded dependency jars and wrapper distributions, never Grails build outputs.
          # Keyed by branch version so each release branch maintains its own warm cache.
          path: |
            ~/.gradle/caches/modules-2
            ~/.gradle/wrapper
          key: gradle-deps-${{ runner.os }}-${{ github.base_ref || github.ref_name }}-${{ hashFiles('**/dependencies.gradle', '**/gradle-wrapper.properties') }}
          restore-keys: |
            gradle-deps-${{ runner.os }}-${{ github.base_ref || github.ref_name }}-
      - name: "🐘 Setup Gradle"
        uses: gradle/actions/setup-gradle@50e97c2cd7a37755bbfafc9c5b7cafaece252f6e # v6.1.0
        with:
          cache-disabled: true # dependency jars are cached by the explicit branch-keyed step above
          develocity-access-key: ${{ secrets.DEVELOCITY_ACCESS_KEY }}
      - name: "🏃 Run Functional Tests"
        env:
          GITHUB_MAVEN_PASSWORD: ${{ secrets.GITHUB_TOKEN }}
        # The Micronaut island is auto-pruned on a sub-25 JDK (settings.gradle), so the
        # Java 21 entries skip it and the Java 25 entries include it (see comment on `build`).
        run: >
          ./gradlew bootJar check
          --continue
          --rerun-tasks
          --stacktrace
          -PgrailsIndy=${{ matrix.indy }}
          -PonlyMongodbTests
          -PmongodbContainerVersion=${{ matrix.mongodb-version }}
          -PskipCodeStyle
  hibernate5Functional:
    if: ${{ !contains(github.event.head_commit.message, '[skip tests]') }}
    name: "Hibernate5 Functional Tests (Java ${{ matrix.java }}, indy=${{ matrix.indy }})"
    runs-on: ubuntu-24.04
    strategy:
      fail-fast: false
      matrix:
        java: [ 21, 25 ]
        indy: [ false ]
        include:
          - java: 21
            indy: true
    steps:
      - name: "Output Agent IP" # in the event RAO blocks this agent, this can be used to debug it
        run: curl -s https://api.ipify.org
      - name: "📥 Checkout the repository"
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
      - name: "☕️ Setup JDK"
        uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
        with:
          distribution: liberica
          java-version: ${{ matrix.java }}
      - name: "🗄️ Restore dependency jar cache"
        uses: actions/cache@v4
        with:
          # Cache only downloaded dependency jars and wrapper distributions, never Grails build outputs.
          # Keyed by branch version so each release branch maintains its own warm cache.
          path: |
            ~/.gradle/caches/modules-2
            ~/.gradle/wrapper
          key: gradle-deps-${{ runner.os }}-${{ github.base_ref || github.ref_name }}-${{ hashFiles('**/dependencies.gradle', '**/gradle-wrapper.properties') }}
          restore-keys: |
            gradle-deps-${{ runner.os }}-${{ github.base_ref || github.ref_name }}-
      - name: "🐘 Setup Gradle"
        uses: gradle/actions/setup-gradle@50e97c2cd7a37755bbfafc9c5b7cafaece252f6e # v6.1.0
        with:
          cache-disabled: true # dependency jars are cached by the explicit branch-keyed step above
          develocity-access-key: ${{ secrets.DEVELOCITY_ACCESS_KEY }}
      - name: "🏃 Run Functional Tests"
        env:
          GITHUB_MAVEN_PASSWORD: ${{ secrets.GITHUB_TOKEN }}
        # The Micronaut island is auto-pruned on a sub-25 JDK (settings.gradle), so the
        # Java 21 entries skip it and the Java 25 entries include it (see comment on `build`).
        run: >
          ./gradlew bootJar check
          --continue
          --rerun-tasks
          --stacktrace
          -PgrailsIndy=${{ matrix.indy }}
          -PonlyHibernate5Tests
          -PskipCodeStyle
  hibernate7Functional:
    if: ${{ !contains(github.event.head_commit.message, '[skip tests]') }}
    name: "Hibernate7 Functional Tests (${{ matrix.job_name }})"
    runs-on: ubuntu-24.04
    strategy:
      fail-fast: false
      matrix:
        include:
          - java: 21
            indy: false
            job_name: Java 21, indy=false
            gradle_task: 'bootJar check'
            shard_arguments: '-PtestShardCount=3 -PtestShardIndex=0'
          - java: 21
            indy: false
            job_name: Java 21, indy=false, shard 1
            gradle_task: testShard
            shard_arguments: '-PtestShardCount=3 -PtestShardIndex=1'
          - java: 21
            indy: false
            job_name: Java 21, indy=false, shard 2
            gradle_task: testShard
            shard_arguments: '-PtestShardCount=3 -PtestShardIndex=2'
          - java: 21
            indy: true
            job_name: Java 21, indy=true
            gradle_task: 'bootJar check'
            shard_arguments: '-PtestShardCount=2 -PtestShardIndex=0'
          - java: 21
            indy: true
            job_name: Java 21, indy=true, shard 1
            gradle_task: testShard
            shard_arguments: '-PtestShardCount=2 -PtestShardIndex=1'
          - java: 25
            indy: false
            job_name: Java 25, indy=false
            gradle_task: 'bootJar check'
            shard_arguments: '-PtestShardCount=2 -PtestShardIndex=0'
          - java: 25
            indy: false
            job_name: Java 25, indy=false, shard 1
            gradle_task: testShard
            shard_arguments: '-PtestShardCount=2 -PtestShardIndex=1'
    steps:
      - name: "Output Agent IP" # in the event RAO blocks this agent, this can be used to debug it
        run: curl -s https://api.ipify.org
      - name: "📥 Checkout the repository"
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
      - name: "☕️ Setup JDK"
        uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
        with:
          distribution: liberica
          java-version: ${{ matrix.java }}
      - name: "🐘 Setup Gradle"
        uses: gradle/actions/setup-gradle@50e97c2cd7a37755bbfafc9c5b7cafaece252f6e # v6.1.0
        with:
          cache-provider: basic # 'basic' uses the MIT-licensed, open-source cache provider; the default 'enhanced' provider (v6+) is proprietary (Gradle commercial Terms of Use)
          develocity-access-key: ${{ secrets.DEVELOCITY_ACCESS_KEY }}
      - name: "🏃 Run Functional Tests"
        env:
          GITHUB_MAVEN_PASSWORD: ${{ secrets.GITHUB_TOKEN }}
        run: >
          ./gradlew ${{ matrix.gradle_task }}
          --continue
          --rerun-tasks
          --stacktrace
          -PgrailsIndy=${{ matrix.indy }}
          -PonlyHibernate7Tests
          -PskipCodeStyle
          ${{ matrix.shard_arguments }}
  publishGradle:
    if: github.repository_owner == 'apache' && (github.event_name == 'push' || github.event_name == 'workflow_dispatch')
    needs: [ buildGradle ]
    runs-on: ubuntu-24.04
    steps:
      - name: "Output Agent IP" # in the event RAO blocks this agent, this can be used to debug it
        run: curl -s https://api.ipify.org
      - name: "📥 Checkout repository"
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
      - name: "☕️ Setup JDK"
        uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
        with:
          distribution: liberica
          java-version: 21
      - name: "🗄️ Restore dependency jar cache"
        uses: actions/cache@v4
        with:
          # Cache only downloaded dependency jars and wrapper distributions, never Grails build outputs.
          # Keyed by branch version so each release branch maintains its own warm cache.
          path: |
            ~/.gradle/caches/modules-2
            ~/.gradle/wrapper
          key: gradle-deps-${{ runner.os }}-${{ github.base_ref || github.ref_name }}-${{ hashFiles('**/dependencies.gradle', '**/gradle-wrapper.properties') }}
          restore-keys: |
            gradle-deps-${{ runner.os }}-${{ github.base_ref || github.ref_name }}-
      - name: "🐘 Setup Gradle"
        uses: gradle/actions/setup-gradle@50e97c2cd7a37755bbfafc9c5b7cafaece252f6e # v6.1.0
        with:
          cache-disabled: true # dependency jars are cached by the explicit branch-keyed step above
          develocity-access-key: ${{ secrets.DEVELOCITY_ACCESS_KEY  }}
      - name: "🔍 Setup TestLens"
        uses: testlens-app/setup-testlens@3f82d2dc6cd5c03f02ce5f7885a21195d85f8d14 # v1.9.3
      - name: "📤 Publish Gradle Snapshot Artifacts"
        env:
          GRAILS_PUBLISH_RELEASE: 'false'
          MAVEN_PUBLISH_URL: ${{ secrets.GRAILS_NEXUS_PUBLISH_SNAPSHOT_URL }}
          MAVEN_PUBLISH_USERNAME: ${{ secrets.NEXUS_USER }}
          MAVEN_PUBLISH_PASSWORD: ${{ secrets.NEXUS_PW  }}
        working-directory: 'grails-gradle'
        run: >
          ./gradlew publish aggregateChecksums aggregatePublishedArtifacts
          --no-build-cache
          --rerun-tasks
      - name: "📤 Upload grails-gradle checksums"
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: grails-gradle-checksums
          path: grails-gradle/build/grails-gradle-checksums.txt
      - name: "📤 Upload grails-gradle published artifacts"
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: grails-gradle-artifacts.txt
          path: grails-gradle/build/grails-gradle-artifacts.txt
  publish:
    needs: [ publishGradle, build, functional, security, securityConfig, redis, hibernate5Functional, hibernate7Functional, mongodbFunctional ]
    if: >-
      ${{ always() &&
          github.repository_owner == 'apache' &&
          (github.event_name == 'push' || github.event_name == 'workflow_dispatch') &&
          needs.publishGradle.result == 'success' &&
          (needs.build.result == 'success' || needs.build.result == 'skipped') &&
          (needs.functional.result == 'success' || needs.functional.result == 'skipped') &&
          (needs.security.result == 'success' || needs.security.result == 'skipped') &&
          (needs.securityConfig.result == 'success' || needs.securityConfig.result == 'skipped') &&
          (needs.redis.result == 'success' || needs.redis.result == 'skipped') &&
          (needs.hibernate5Functional.result == 'success' || needs.hibernate5Functional.result == 'skipped') &&
          (needs.hibernate7Functional.result == 'success' || needs.hibernate7Functional.result == 'skipped') &&
          (needs.mongodbFunctional.result == 'success' || needs.mongodbFunctional.result == 'skipped')
      }}
    runs-on: ubuntu-24.04
    steps:
      - name: "Output Agent IP" # in the event RAO blocks this agent, this can be used to debug it
        run: curl -s https://api.ipify.org
      - name: "📥 Checkout repository"
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
      - name: "☕️ Setup JDK"
        uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
        with:
          distribution: liberica
          java-version: 21
      - name: "🗄️ Restore dependency jar cache"
        uses: actions/cache@v4
        with:
          # Cache only downloaded dependency jars and wrapper distributions, never Grails build outputs.
          # Keyed by branch version so each release branch maintains its own warm cache.
          path: |
            ~/.gradle/caches/modules-2
            ~/.gradle/wrapper
          key: gradle-deps-${{ runner.os }}-${{ github.base_ref || github.ref_name }}-${{ hashFiles('**/dependencies.gradle', '**/gradle-wrapper.properties') }}
          restore-keys: |
            gradle-deps-${{ runner.os }}-${{ github.base_ref || github.ref_name }}-
      - name: "🐘 Setup Gradle"
        uses: gradle/actions/setup-gradle@50e97c2cd7a37755bbfafc9c5b7cafaece252f6e # v6.1.0
        with:
          cache-disabled: true # dependency jars are cached by the explicit branch-keyed step above
          develocity-access-key: ${{ secrets.DEVELOCITY_ACCESS_KEY  }}
      - name: "🔍 Setup TestLens"
        uses: testlens-app/setup-testlens@3f82d2dc6cd5c03f02ce5f7885a21195d85f8d14 # v1.9.3
      - name: "📤 Publish Grails-Core Snapshot Artifacts"
        # This Java 21 publish excludes the Micronaut 5 / JVM 25 island automatically -
        # settings.gradle prunes it on a sub-25 JDK. The island artifacts (grails-micronaut,
        # grails-micronaut-bom) are published by the parallel publishMicronaut job below,
        # which runs on JDK 25.
        uses: nick-fields/retry@ad984534de44a9489a53aefd81eb77f87c70dc60 # v4.0.0
        env:
          GRAILS_PUBLISH_RELEASE: 'false'
          MAVEN_PUBLISH_URL: ${{ secrets.GRAILS_NEXUS_PUBLISH_SNAPSHOT_URL }}
          MAVEN_PUBLISH_USERNAME: ${{ secrets.NEXUS_USER }}
          MAVEN_PUBLISH_PASSWORD: ${{ secrets.NEXUS_PW  }}
        with: 
          timeout_seconds: 3600 # normal range ~14-25min uncached (no tests); generous headroom for slow Nexus uploads so a single attempt is not killed mid-publish
          max_attempts: 3 # Attempts to address: Could not write to resource 'https://repository.apache.org/content/repositories/snapshots/...' Read timed out
          retry_wait_seconds: 180
          command: ./gradlew publish aggregateChecksums aggregatePublishedArtifacts --no-build-cache --rerun-tasks
      - name: "📤 Upload grails-core checksums"
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: grails-core-checksums.txt
          path: build/grails-core-checksums.txt
      - name: "📤 Upload grails-core published artifacts"
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: grails-core-artifacts.txt
          path: build/grails-core-artifacts.txt
      - name: "🔨 Create Grails Wrapper Distribution Zip"
        run: |
          ./gradlew :grails-wrapper:distZip
          cp grails-wrapper/build/distributions/apache-grails-wrapper-*.zip build/wrapper.zip
          cd build
          unzip wrapper -d tmp
          mv tmp/apache-grails-wrapper-* tmp/wrapper
      - name: "📤 Upload Wrapper Zip to Workflow Summary Page"
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: apache-grails-wrapper-SNAPSHOT-bin
          path: build/tmp/wrapper
  publishMicronaut:
    # Micronaut 5.0.0 publishes JARs targeting JVM 25 bytecode, so the Micronaut
    # "island" (grails-micronaut, grails-micronaut-bom) must publish from a JDK 25
    # runner. The sibling `publish` job runs on JDK 21, where settings.gradle
    # auto-prunes the island, so it publishes everything else; this job publishes
    # the two Micronaut artifacts. The two test-example projects in the island are
    # not published.
    needs: [ publishGradle, build, functional, hibernate5Functional, mongodbFunctional ]
    if: >-
      ${{ always() &&
          github.repository_owner == 'apache' &&
          (github.event_name == 'push' || github.event_name == 'workflow_dispatch') &&
          needs.publishGradle.result == 'success' &&
          (needs.build.result == 'success' || needs.build.result == 'skipped') &&
          (needs.functional.result == 'success' || needs.functional.result == 'skipped') &&
          (needs.hibernate5Functional.result == 'success' || needs.hibernate5Functional.result == 'skipped') &&
          (needs.mongodbFunctional.result == 'success' || needs.mongodbFunctional.result == 'skipped')
      }}
    runs-on: ubuntu-24.04
    steps:
      - name: "Output Agent IP" # in the event RAO blocks this agent, this can be used to debug it
        run: curl -s https://api.ipify.org
      - name: "📥 Checkout repository"
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
      - name: "☕️ Setup JDK"
        uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
        with:
          distribution: liberica
          java-version: 25
      - name: "🐘 Setup Gradle"
        uses: gradle/actions/setup-gradle@50e97c2cd7a37755bbfafc9c5b7cafaece252f6e # v6.1.0
        with:
          cache-provider: basic # 'basic' uses the MIT-licensed, open-source cache provider; the default 'enhanced' provider (v6+) is proprietary (Gradle commercial Terms of Use)
          develocity-access-key: ${{ secrets.DEVELOCITY_ACCESS_KEY  }}
      - name: "🔍 Setup TestLens"
        uses: testlens-app/setup-testlens@3f82d2dc6cd5c03f02ce5f7885a21195d85f8d14 # v1.9.3
      - name: "📤 Publish Grails-Micronaut Snapshot Artifacts"
        uses: nick-fields/retry@ad984534de44a9489a53aefd81eb77f87c70dc60 # v4.0.0
        env:
          GRAILS_PUBLISH_RELEASE: 'false'
          MAVEN_PUBLISH_URL: ${{ secrets.GRAILS_NEXUS_PUBLISH_SNAPSHOT_URL }}
          MAVEN_PUBLISH_USERNAME: ${{ secrets.NEXUS_USER }}
          MAVEN_PUBLISH_PASSWORD: ${{ secrets.NEXUS_PW  }}
        with:
          timeout_seconds: 1800 # headroom for slow Nexus uploads so a single attempt is not killed mid-publish (see `publish` job)
          max_attempts: 3
          retry_wait_seconds: 180
          command: ./gradlew :grails-micronaut:publish :grails-micronaut-bom:publish --no-build-cache --rerun-tasks
  publishForge:
    if: github.repository_owner == 'apache' && (github.event_name == 'push' || github.event_name == 'workflow_dispatch')
    needs: [ buildForge, publishGradle, publish ]
    runs-on: ubuntu-24.04
    steps:
      - name: "Output Agent IP" # in the event RAO blocks this agent, this can be used to debug it
        run: curl -s https://api.ipify.org
      - name: "📥 Checkout repository"
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
      - name: "☕️ Setup JDK"
        uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
        with:
          distribution: liberica
          java-version: 21
      - name: "🗄️ Restore dependency jar cache"
        uses: actions/cache@v4
        with:
          # Cache only downloaded dependency jars and wrapper distributions, never Grails build outputs.
          # Keyed by branch version so each release branch maintains its own warm cache.
          path: |
            ~/.gradle/caches/modules-2
            ~/.gradle/wrapper
          key: gradle-deps-${{ runner.os }}-${{ github.base_ref || github.ref_name }}-${{ hashFiles('**/dependencies.gradle', '**/gradle-wrapper.properties') }}
          restore-keys: |
            gradle-deps-${{ runner.os }}-${{ github.base_ref || github.ref_name }}-
      - name: "🐘 Setup Gradle"
        uses: gradle/actions/setup-gradle@50e97c2cd7a37755bbfafc9c5b7cafaece252f6e # v6.1.0
        with:
          cache-disabled: true # dependency jars are cached by the explicit branch-keyed step above
          develocity-access-key: ${{ secrets.DEVELOCITY_ACCESS_KEY  }}
      - name: "🔍 Setup TestLens"
        uses: testlens-app/setup-testlens@3f82d2dc6cd5c03f02ce5f7885a21195d85f8d14 # v1.9.3
      - name: "📤 Publish Gradle Snapshot Artifacts"
        env:
          GRAILS_PUBLISH_RELEASE: 'false'
          MAVEN_PUBLISH_URL: ${{ secrets.GRAILS_NEXUS_PUBLISH_SNAPSHOT_URL }}
          MAVEN_PUBLISH_USERNAME: ${{ secrets.NEXUS_USER }}
          MAVEN_PUBLISH_PASSWORD: ${{ secrets.NEXUS_PW  }}
        working-directory: 'grails-forge'
        run: >
          ./gradlew publish aggregateChecksums aggregatePublishedArtifacts
          --no-build-cache
          --rerun-tasks
      - name: "📤 Upload grails-forge checksums"
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: grails-forge-checksums
          path: grails-forge/build/grails-forge-checksums.txt
      - name: "📤 Upload grails-gradle published artifacts"
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: grails-forge-artifacts.txt
          path: grails-forge/build/grails-forge-artifacts.txt
  verifyWrapper:
    name: "Verify grails-wrapper"
    # Verifies the wrapper works end-to-end. Must run after publishForge so that
    # grails-cli (which the wrapper resolves at runtime) is available in Nexus.
    if: github.repository_owner == 'apache' && (github.event_name == 'push' || github.event_name == 'workflow_dispatch')
    needs: [ publish, publishForge ]
    runs-on: ubuntu-24.04
    steps:
      - name: "Output Agent IP" # in the event RAO blocks this agent, this can be used to debug it
        run: curl -s https://api.ipify.org
      - name: "📥 Checkout repository"
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
      - name: "☕️ Setup JDK"
        uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
        with:
          distribution: liberica
          java-version: 21
      - name: "📥 Download Wrapper"
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          name: apache-grails-wrapper-SNAPSHOT-bin
          path: wrapper
      - name: "✅ Verify grails-wrapper"
        env:
          GRAILS_WRAPPER_ALLOWED_TYPES: 'SNAPSHOT'
        run: |
          # Pin the wrapper to this branch's snapshot so it doesn't resolve the
          # globally latest SNAPSHOT in the Apache repo, which may be compiled
          # for a newer Java runtime than this job's JDK.
          export PREFERRED_GRAILS_VERSION=$(grep '^projectVersion=' gradle.properties | cut -d'=' -f2)
          # actions/download-artifact does not preserve the executable bit, so
          # restore it before invoking the wrapper script (see actions/upload-artifact#38).
          chmod +x ./wrapper/grailsw
          ./wrapper/grailsw --version
  docs:
    if: github.repository_owner == 'apache' && github.event_name == 'push'
    needs: [ publish ]
    runs-on: ubuntu-24.04
    # Documentation publishing targets a shared resource (the apache/grails-website repo).
    # Share the static group used by the release documentation publish (release.yml) so only
    # one documentation publish can run at a time across every branch; the rest queue.
    concurrency:
      group: grails-docs-publish
      cancel-in-progress: false
    steps:
      - name: "⚙️ Maximize build space"
        run: |
          echo "-- Dotnet"
          sudo rm -rf /usr/share/dotnet
          echo "-- Android"
          sudo rm -rf /usr/local/lib/android
          echo "-- Haskell"
          sudo rm -rf /opt/ghc
          echo "-- CodeQL"
          sudo rm -rf /opt/hostedtoolcache/CodeQL

          df -h
      - name: "Output Agent IP" # in the event RAO blocks this agent, this can be used to debug it
        run: curl -s https://api.ipify.org
      - name: "📥 Checkout the repository"
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          fetch-tags: true
      - name: "🔀 Store current branch name"
        run: |
          TARGET_BRANCH="${GITHUB_BASE_REF:-${GITHUB_REF#refs/heads/}}"
          echo "TARGET_BRANCH=${TARGET_BRANCH}" >> $GITHUB_ENV
          echo "Target Branch: ${TARGET_BRANCH}"
      - name: "📅 Set current date as env variable"
        run: |
          NOW=$(date +'%Y-%m-%dT%H%M%S')
          echo "NOW=${NOW}" >> $GITHUB_ENV
          echo "Current date: ${NOW}"
      - name: "☕️ Setup JDK"
        uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
        with:
          distribution: liberica
          java-version: 21
      - name: "🗄️ Restore dependency jar cache"
        uses: actions/cache@v4
        with:
          # Cache only downloaded dependency jars and wrapper distributions, never Grails build outputs.
          # Keyed by branch version so each release branch maintains its own warm cache.
          path: |
            ~/.gradle/caches/modules-2
            ~/.gradle/wrapper
          key: gradle-deps-${{ runner.os }}-${{ github.base_ref || github.ref_name }}-${{ hashFiles('**/dependencies.gradle', '**/gradle-wrapper.properties') }}
          restore-keys: |
            gradle-deps-${{ runner.os }}-${{ github.base_ref || github.ref_name }}-
      - name: "🐘 Setup Gradle"
        uses: gradle/actions/setup-gradle@50e97c2cd7a37755bbfafc9c5b7cafaece252f6e # v6.1.0
        with:
          cache-disabled: true # dependency jars are cached by the explicit branch-keyed step above
          develocity-access-key: ${{ secrets.DEVELOCITY_ACCESS_KEY }}
      - name: "🔨 Build Snapshot Documentation"
        run: >
          ./gradlew grails-doc:build
          -PgithubBranch=${{ env.TARGET_BRANCH }}
      - name: "📤 Upload Generated Docs to Workflow Result Page"
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: grails-docs-${{ env.NOW }}.zip
          path: ./build/distributions/*.zip
          compression-level: 0 # Already a zip
      - name: "🚀 Publish to Github Pages"
        if: github.event_name == 'push'
        uses: apache/grails-github-actions/deploy-github-pages@asf
        env:
          GH_TOKEN: ${{ secrets.GRAILS_GHTOKEN }}
          GRADLE_PUBLISH_RELEASE: 'false'
          SOURCE_FOLDER: grails-doc/build/docs
          TARGET_REPOSITORY: 'apache/grails-website'
          TARGET_FOLDER: 'docs'
          DOCUMENTATION_BRANCH: 'asf-site-production'