Groovy 5.0.x support for Grails 8 + Spring Boot 4

.github/scripts/groovy-joint-build.init.gradle

@@ -0,0 +1,56 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements.  See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License.  You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+// Gradle init-script applied during the Groovy joint-validation build.
+// Overrides Develocity and build-cache configuration injected by Groovy's own
+// build-scans.gradle without modifying any of Groovy's source files.
+//
+// Applied via: ./gradlew --init-script <path>/groovy-joint-build.init.gradle
+//
+// Defensive: the pluginManager.withPlugin guard makes this a no-op when the
+// Develocity plugin is absent, so the script never crashes Groovy's build.
+
+settingsEvaluated { settings ->
+    settings.pluginManager.withPlugin('com.gradle.develocity') {
+        def isAuthenticated = System.getenv('GRAILS_DEVELOCITY_ACCESS_KEY') != null
+
+        // 'develocity' is the DSL extension registered by the plugin on Settings.
+        settings.develocity {
+            server = 'https://develocity.apache.org'
+
+            buildScan {
+                // Tag the build for visibility on develocity.apache.org. Groovy's own
+                // gradle/build-scans.gradle does not add any tags, so additive is safe.
+                tag('groovy')
+                tag('grails-core')
+                // Only publish when a valid access key is present in the environment.
+                publishing.onlyIf { isAuthenticated }
+                uploadInBackground = false
+            }
+        }
+
+        settings.buildCache {
+            local {
+                enabled = false
+            }
+            remote(settings.develocity.buildCache) {
+                push = isAuthenticated
+                enabled = true
+            }
+        }
+    }
+}

.github/workflows/groovy-joint-workflow.yml

@@ -45,23 +45,40 @@ jobs:
         with:
           path: ~/.m2/repository
           key: cache-local-maven-${{ github.sha }}
-      - name: "📥 Checkout Grails Core to fetch Gradle Plugin versions it uses"
+      - name: "📥 Checkout Grails Core files needed for the Groovy joint-build"
+        # Sparse-checkout fetches only the two paths this job actually needs:
+        #   - dependencies.gradle: parsed below to derive the matching Apache
+        #     Groovy branch (GROOVY_<major>_0_X) for this Grails branch.
+        #   - .github/scripts/groovy-joint-build.init.gradle: passed to
+        #     ./gradlew --init-script when publishing Groovy to local Maven so
+        #     the joint build reuses our Develocity / build-cache settings.
+        # Both paths must be listed here; otherwise the init-script step fails
+        # with "The specified initialization script ... does not exist."
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           sparse-checkout-cone-mode: false
-          sparse-checkout: settings.gradle
-      - name: "📝 Store the Gradle Plugin versions used in this project"
-        id: gradle-plugin-versions
+          sparse-checkout: |
+            dependencies.gradle
+            .github/scripts/groovy-joint-build.init.gradle
+      - name: "📝 Derive matching Apache Groovy branch from dependencies.gradle"
+        id: groovy-branch
         run: |
-          DEVELOCITY_PLUGIN_VERSION=$(grep -m 1 'id\s*\(\"com.gradle.develocity\"\|'"'com.gradle.develocity'"'\)\s*version' settings.gradle | sed -E "s/.*version[[:space:]]*['\"]?([0-9]+\.[0-9]+(\.[0-9]+)?)['\"]?.*/\1/" | tr -d [:space:])
-          COMMON_CUSTOM_USER_DATA_PLUGIN_VERSION=$(grep -m 1 'id\s*\(\"com.gradle.common-custom-user-data-gradle-plugin\"\|'"'com.gradle.common-custom-user-data-gradle-plugin'"'\)\s*version' settings.gradle | sed -E "s/.*version[[:space:]]*['\"]?([0-9]+\.[0-9]+(\.[0-9]+)?)['\"]?.*/\1/" | tr -d [:space:])
-          echo "Project uses Develocity Plugin version: $DEVELOCITY_PLUGIN_VERSION"
-          echo "Project uses Common Custom User Data Plugin version: $COMMON_CUSTOM_USER_DATA_PLUGIN_VERSION"
-          echo "develocity_plugin_version=$DEVELOCITY_PLUGIN_VERSION" >> $GITHUB_OUTPUT
-          echo "common_custom_user_data_plugin_version=$COMMON_CUSTOM_USER_DATA_PLUGIN_VERSION" >> $GITHUB_OUTPUT
-          rm settings.gradle
-      - name: "📥 Checkout Groovy 4_0_X (Grails 7 and later)"
-        run: git clone --depth 1 https://github.com/apache/groovy.git -b GROOVY_4_0_X --single-branch
+          # Extract the major version of `groovy.version` declared in this branch's
+          # dependencies.gradle (e.g. '5.0.5' -> '5', '4.0.31' -> '4') and use it to
+          # pick the matching Apache Groovy development branch (GROOVY_<major>_0_X).
+          # This keeps `7.0.x` PRs validating against Groovy 4 and `8.0.x` PRs
+          # validating against Groovy 5 without hard-coding the branch here.
+          GROOVY_MAJOR=$(grep -m 1 "'groovy\.version'" dependencies.gradle | sed -E "s/.*'([0-9]+)\.[0-9]+\.[0-9]+.*/\1/" | tr -d '[:space:]')
+          if [ -z "$GROOVY_MAJOR" ]; then
+            echo "::error::Could not determine Apache Groovy major version from dependencies.gradle"
+            exit 1
+          fi
+          GROOVY_BRANCH="GROOVY_${GROOVY_MAJOR}_0_X"
+          echo "Validating against Apache Groovy branch: $GROOVY_BRANCH"
+          echo "value=$GROOVY_BRANCH" >> $GITHUB_OUTPUT
+          rm dependencies.gradle
+      - name: "📥 Checkout Apache Groovy (${{ steps.groovy-branch.outputs.value }})"
+        run: git clone --depth 1 https://github.com/apache/groovy.git -b ${{ steps.groovy-branch.outputs.value }} --single-branch
       - name: "🐘 Setup Gradle"
         uses: gradle/actions/setup-gradle@50e97c2cd7a37755bbfafc9c5b7cafaece252f6e # v6.1.0
         with:
@@ -76,54 +93,11 @@ jobs:
           GROOVY_VERSION=$(cat gradle.properties | grep groovyVersion | cut -d\= -f2 |  tr -d '[:space:]')
           echo "Groovy version $GROOVY_VERSION stored"
           echo "value=$GROOVY_VERSION" >> $GITHUB_OUTPUT
-      - name: "🐘 Configure Gradle Plugins (Step 1/3)"
-        id: develocity-conf-1
-        run: |
-          echo "VALUE<<EOF" >> $GITHUB_OUTPUT
-          echo "plugins { " >> $GITHUB_OUTPUT
-          echo "    id 'com.gradle.develocity' version '${{ steps.gradle-plugin-versions.outputs.develocity_plugin_version }}'" >> $GITHUB_OUTPUT 
-          echo "    id 'com.gradle.common-custom-user-data-gradle-plugin' version '${{ steps.gradle-plugin-versions.outputs.common_custom_user_data_plugin_version }}'" >> $GITHUB_OUTPUT 
-          echo "}" >> $GITHUB_OUTPUT 
-          echo "" >> $GITHUB_OUTPUT 
-          echo "EOF" >> $GITHUB_OUTPUT
-      - name: "🐘 Configure Gradle Plugins (Step 2/3)"
-        id: develocity-conf-2
-        run: |
-          echo "VALUE<<EOF" >> $GITHUB_OUTPUT
-          echo "def isAuthenticated = System.getenv('DEVELOCITY_ACCESS_KEY ') != null" >> $GITHUB_OUTPUT
-          echo "develocity {" >> $GITHUB_OUTPUT
-          echo "    server = 'https://develocity.apache.org'" >> $GITHUB_OUTPUT
-          echo "    buildScan {" >> $GITHUB_OUTPUT
-          echo "        tag('groovy')" >> $GITHUB_OUTPUT
-          echo "        tag('grails-core')" >> $GITHUB_OUTPUT
-          echo "        publishing.onlyIf { isAuthenticated }" >> $GITHUB_OUTPUT
-          echo "        uploadInBackground = false" >> $GITHUB_OUTPUT
-          echo "    }" >> $GITHUB_OUTPUT
-          echo "}" >> $GITHUB_OUTPUT
-          echo "buildCache {" >> $GITHUB_OUTPUT
-          echo "    local { enabled = false }" >> $GITHUB_OUTPUT
-          echo "    remote(develocity.buildCache) {" >> $GITHUB_OUTPUT
-          echo "        push = isAuthenticated" >> $GITHUB_OUTPUT
-          echo "        enabled = true" >> $GITHUB_OUTPUT
-          echo "    }" >> $GITHUB_OUTPUT
-          echo "}" >> $GITHUB_OUTPUT
-          echo "" >> $GITHUB_OUTPUT
-          echo "EOF" >> $GITHUB_OUTPUT
-      - name: "🐘 Configure Gradle Plugins (step 3/3)"
-        run: |
-          cd groovy
-          # Delete existing plugins from settings.gradle file
-          sed -i '32,37d' settings.gradle
-          # Add Develocity setup related configuration after line no 31 in settings.gradle
-          echo "${{ steps.develocity-conf-1.outputs.value }}" | sed -i -e "31r /dev/stdin" settings.gradle
-          # Delete existing buildCache configuration from gradle/build-scans.gradle file
-          sed -i '23,46d' gradle/build-scans.gradle
-          # Add Develocity setup related configuration after line no 22 in gradle/build-scans.gradle
-          echo "${{ steps.develocity-conf-2.outputs.value }}" | sed -i -e "22r /dev/stdin" gradle/build-scans.gradle
       - name: "🔨 Publish Groovy to local maven repository (no docs)"
         run: |
           cd groovy
-          ./gradlew pTML -x groovydoc -x javadoc -x javadocAll -x groovydocAll -x asciidoc -x docGDK
+          ./gradlew pTML -x groovydoc -x javadoc -x javadocAll -x groovydocAll -x asciidoc -x docGDK \
+            --init-script $GITHUB_WORKSPACE/.github/scripts/groovy-joint-build.init.gradle
 
   build_grails:
     needs: [build_groovy]

build-logic/plugins/src/main/groovy/org/apache/grails/buildsrc/SbomPlugin.groovy

@@ -88,15 +88,25 @@ class SbomPlugin implements Plugin<Project> {
     ]
 
     private static Map<String, String> LICENSE_MAPPING = [
-            'pkg:maven/org.antlr/antlr4-runtime@4.7.2?type=jar'               : 'BSD-3-Clause', // maps incorrectly because of https://github.com/CycloneDX/cyclonedx-core-java/issues/205
-            'pkg:maven/jline/jline@2.14.6?type=jar'                           : 'BSD-2-Clause', // maps incorrectly because of https://github.com/CycloneDX/cyclonedx-core-java/issues/205
-            'pkg:maven/org.jline/jline@3.30.6?type=jar'                       : 'BSD-3-Clause', // maps incorrectly because of https://github.com/CycloneDX/cyclonedx-core-java/issues/205
-            'pkg:maven/org.liquibase.ext/liquibase-hibernate5@4.27.0?type=jar': 'Apache-2.0', // maps incorrectly because of https://github.com/liquibase/liquibase/issues/2445 & the base pom does not define a license
             'pkg:maven/com.oracle.coherence.ce/coherence-bom@25.03.1?type=pom': 'UPL-1.0', // does not have map based on license id
             'pkg:maven/com.oracle.coherence.ce/coherence-bom@25.03.2?type=pom': 'UPL-1.0', // does not have map based on license id
             'pkg:maven/com.oracle.coherence.ce/coherence-bom@22.06.2?type=pom': 'UPL-1.0', // does not have map based on license id
+            'pkg:maven/jline/jline@2.14.6?type=jar'                           : 'BSD-2-Clause', // maps incorrectly because of https://github.com/CycloneDX/cyclonedx-core-java/issues/205
             'pkg:maven/opensymphony/sitemesh@2.6.0?type=jar'                  : 'OpenSymphony', // custom license approved by legal LEGAL-707
-            'pkg:maven/org.jruby/jzlib@1.1.5?type=jar'                        : 'BSD-3-Clause'// https://web.archive.org/web/20240822213507/http://www.jcraft.com/jzlib/LICENSE.txt shows it's a 3 clause
+            'pkg:maven/org.antlr/antlr4-runtime@4.7.2?type=jar'               : 'BSD-3-Clause', // maps incorrectly because of https://github.com/CycloneDX/cyclonedx-core-java/issues/205
+            'pkg:maven/org.jline/jansi@3.30.9?type=jar'                       : 'BSD-3-Clause', // jline group resolved at 3.30.9 transitively via groovy-groovysh; main org.jline:jline pinned at 3.30.6 directly
+            'pkg:maven/org.jline/jline@3.30.6?type=jar'                       : 'BSD-3-Clause', // direct dependency declared at jline.version in dependencies.gradle
+            'pkg:maven/org.jline/jline-builtins@3.30.9?type=jar'              : 'BSD-3-Clause', // jline group resolved at 3.30.9 transitively via groovy-groovysh; main org.jline:jline pinned at 3.30.6 directly
+            'pkg:maven/org.jline/jline-console@3.30.9?type=jar'               : 'BSD-3-Clause', // jline group resolved at 3.30.9 transitively via groovy-groovysh; main org.jline:jline pinned at 3.30.6 directly
+            'pkg:maven/org.jline/jline-native@3.30.9?type=jar'                : 'BSD-3-Clause', // jline group resolved at 3.30.9 transitively via groovy-groovysh; main org.jline:jline pinned at 3.30.6 directly
+            'pkg:maven/org.jline/jline-reader@3.30.9?type=jar'                : 'BSD-3-Clause', // jline group resolved at 3.30.9 transitively via groovy-groovysh; main org.jline:jline pinned at 3.30.6 directly
+            'pkg:maven/org.jline/jline-style@3.30.9?type=jar'                 : 'BSD-3-Clause', // jline group resolved at 3.30.9 transitively via groovy-groovysh; main org.jline:jline pinned at 3.30.6 directly
+            'pkg:maven/org.jline/jline-terminal@3.30.9?type=jar'              : 'BSD-3-Clause', // jline group resolved at 3.30.9 transitively via groovy-groovysh; main org.jline:jline pinned at 3.30.6 directly
+            'pkg:maven/org.jline/jline-terminal-jansi@3.30.9?type=jar'        : 'BSD-3-Clause', // jline group resolved at 3.30.9 transitively via groovy-groovysh; main org.jline:jline pinned at 3.30.6 directly
+            'pkg:maven/org.jline/jline-terminal-jna@3.30.9?type=jar'          : 'BSD-3-Clause', // jline group resolved at 3.30.9 transitively via groovy-groovysh; main org.jline:jline pinned at 3.30.6 directly
+            'pkg:maven/org.jline/jline-terminal-jni@3.30.9?type=jar'          : 'BSD-3-Clause', // jline group resolved at 3.30.9 transitively via groovy-groovysh; main org.jline:jline pinned at 3.30.6 directly
+            'pkg:maven/org.jruby/jzlib@1.1.5?type=jar'                        : 'BSD-3-Clause', // https://web.archive.org/web/20240822213507/http://www.jcraft.com/jzlib/LICENSE.txt shows it's a 3 clause
+            'pkg:maven/org.liquibase.ext/liquibase-hibernate5@4.27.0?type=jar': 'Apache-2.0', // maps incorrectly because of https://github.com/liquibase/liquibase/issues/2445 & the base pom does not define a license
     ]
 
     // we don't distribute these so these licenses are considered acceptable, but we still prefer ASF licenses.

dependencies.gradle

@@ -33,7 +33,7 @@ ext {
             'gradle-spock.version'          : '2.3-groovy-4.0',
             'grails-publish-plugin.version' : '1.0.0-M1',
             'jansi.version'                 : '2.4.2',
-            'javaparser-core.version'       : '3.28.0',
+            'javaparser-core.version'       : '3.28.2',
             'jline.version'                 : '3.30.6',
             'jline2.version'                : '2.14.6',
             'jna.version'                   : '5.18.1',
@@ -80,19 +80,22 @@ ext {
             'geb-spock.version'             : '8.0.1',
             'graphql-java.version'          : '25.0',
             'graphql-java-extended-scalars.version': '24.0',
-            'groovy.version'                : '4.0.32',
+            'groovy.version'                : '5.0.7-SNAPSHOT',
             'hibernate-groovy-proxy.version': '1.1',
             'jakarta-servlet-api.version'   : '6.1.0',
-            'jakarta-validation.version': '3.1.1',
+            'jakarta-validation.version'    : '3.1.1',
             'jquery.version'                : '3.7.1',
             'junit.version'                 : '6.0.3',
+            'kotlin.version'                : '2.2.21',
+            'liquibase-hibernate5.version'  : '4.27.0',
+            'mockito.version'               : '5.23.0',
             'mongodb.version'               : '5.7.0-beta1',
             'rxjava.version'                : '1.3.8',
             'rxjava2.version'               : '2.2.21',
             'rxjava3.version'               : '3.1.12',
             'selenium.version'              : '4.38.0',
             'sitemesh.version'              : '2.6.0',
-            'spock.version'                 : '2.3-groovy-4.0',
+            'spock.version'                 : '2.4-groovy-5.0',
             'starter-sitemesh.version'      : '3.2.3',
             'spring-webmvc-sitemesh.version': '3.2.3',
             // Spring Boot 4 no longer manages spring-retry; pin it here so the
@@ -222,7 +225,10 @@ ext {
                 'liquibase-hibernate.version': '4.27.0',
                 'liquibase.version'          : '4.27.0',
                 'hibernate.version'          : '5.6.15.Final',
-                'groovy.version'  : '5.0.5',
+                // Keep aligned with bomDependencyVersions['groovy.version']; the main bom now uses
+                // Groovy 5, so the micronaut bom must match to avoid validateDependencyVersions
+                // failures from transitive dependencies upgrading groovy-bom past the pinned version.
+                'groovy.version'  : '5.0.7-SNAPSHOT',
                 'spock.version'   : '2.4-groovy-5.0',
                 'protobuf.version': '4.30.2',
         ]

gradle/boot4-disabled-integration-test-config.gradle

@@ -15,16 +15,13 @@
  *  limitations under the License.
  */
 
-// TODO: BOOT4 - Integration tests disabled due to Spring Boot 4 incompatibilities.
-//
-// Modules applying this file have their integrationTest task disabled because of
-// external plugin/library incompatibilities with Spring Boot 4 / Spring Framework 7.
-//
-// Known blockers:
-//   - SiteMesh3: Decorator/layout not compatible with Spring Framework 7
-//
-// Re-enable each module's integrationTest when its blocking dependency is updated.
-// Search for 'boot4-disabled-integration-test-config' to find all affected modules.
+// integrationTest is disabled for modules applying this file.
+// Blocker: Groovy 5 + indy=false drops the scope of controller action parameters/locals
+// after ControllerActionTransformer re-parents the body inside a TryCatchStatement, so they
+// resolve to propertyMissing on the controller and throw MissingPropertyException. Re-running
+// VariableScopeVisitor does not rebind them; this needs an upstream Groovy fix. indy=true passes.
+// Reproducer: https://github.com/jamesfredley/groovy5-controller-action-param-scope-bug
+// Re-enable once the upstream fix lands.
 
 tasks.named('integrationTest') {
     enabled = false

gradle/hibernate5-test-config.gradle

@@ -20,6 +20,8 @@
 dependencies {
     // https://docs.gradle.org/8.3/userguide/upgrading_version_8.html#test_framework_implementation_dependencies
     add('testRuntimeOnly', 'org.junit.platform:junit-platform-launcher')
+    add('testRuntimeOnly', 'net.bytebuddy:byte-buddy')
+    add('testRuntimeOnly', 'org.objenesis:objenesis')
 }
 
 tasks.withType(Test).configureEach {

gradle/mongodb-forked-test-config.gradle

@@ -20,6 +20,8 @@
 dependencies {
     // https://docs.gradle.org/8.3/userguide/upgrading_version_8.html#test_framework_implementation_dependencies
     add('testRuntimeOnly', 'org.junit.platform:junit-platform-launcher')
+    add('testRuntimeOnly', 'net.bytebuddy:byte-buddy')
+    add('testRuntimeOnly', 'org.objenesis:objenesis')
 }
 
 tasks.named('compileTestGroovy', GroovyCompile) {

gradle/mongodb-test-config.gradle

@@ -20,6 +20,8 @@
 dependencies {
     // https://docs.gradle.org/8.3/userguide/upgrading_version_8.html#test_framework_implementation_dependencies
     add('testRuntimeOnly', 'org.junit.platform:junit-platform-launcher')
+    add('testRuntimeOnly', 'net.bytebuddy:byte-buddy')
+    add('testRuntimeOnly', 'org.objenesis:objenesis')
 }
 
 tasks.named('compileTestGroovy', GroovyCompile) {

gradle/plugin-repositories.gradle

@@ -36,6 +36,7 @@ ext.configurePluginRepositories = { RepositoryHandler repositories ->
         url = uri('https://central.sonatype.com/repository/maven-snapshots')
         content {
             includeGroupByRegex('cloud[.]wondrify[.].*')
+            includeGroup('org.spockframework')
         }
         mavenContent {
             snapshotsOnly()