fix(deps): upgrade shadow plugin to resolve log4j-core XmlLayout vuln (COMP-1573) (#120)

* fix(deps): upgrade shadow plugin to resolve log4j-core XmlLayout vuln (COMP-1573)

The com.github.johnrengelman.shadow 8.1.1 build plugin transitively bundled
org.apache.logging.log4j:log4j-core 2.20.0 in the build tooling classpath, which
is affected by CVE-2026-34480 / GHSA-3pxv-7cmr-fjr4 (XmlLayout fails to sanitize
characters forbidden by the XML 1.0 spec; fixed in log4j-core 2.25.4).

Migrate to the successor plugin com.gradleup.shadow 9.5.0, which ships
log4j-core 2.26.1 (>= 2.25.4). Shadow 9.x requires Gradle 9, so the Gradle
wrapper is bumped 8.13 -> 9.6.1 and the GraalVM native-build-tools plugin
0.10.6 -> 1.1.3 (first line to support Gradle 9). Verified: shadowJar builds
and all tests pass under Gradle 9.6.1.

See: https://github.com/seqeralabs/wave-cli/security/dependabot/16

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* ci: pin graalvm/setup-graalvm to full commit SHA (COMP-1573)

The repo/org policy requires all GitHub Actions to be pinned to a full-length
commit SHA. Pin graalvm/setup-graalvm@v1 -> @cabbb10818fabc989d6dbd508e4846596d20dd2d
(v1.6.0) in build.yml (both native-image steps) and the dependency-graph workflow,
matching the SHA-pinning convention already used for the other actions.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* ci(build): bump JDK toolchain to 25 to fix native compile (COMP-1573)

The shadow-plugin migration for the log4j fix pulled in Gradle 9 and
native-build-tools 1.1.3, whose GraalVM reachability-metadata repository
requires a newer reachability-metadata schema than GraalVM for JDK 21
provides. CI `nativeCompile` failed on that schema mismatch.

Bump the build toolchain to JDK 25 across the repo so the GraalVM
reachability metadata schema is supported:
- setup-graalvm / setup-java java-version 21 -> 25 in build.yml and
  security-submit-dependecy-graph.yml
- Gradle toolchain and native launcher languageVersion 21 -> 25
- Groovy test deps 4.0.24 -> 4.0.32 (4.0.24 cannot compile against JDK 25
  class files: "Unsupported class file major version 69")

sourceCompatibility/targetCompatibility stay at 17, so the shipped fat
jar still runs on JRE 17+.

Also fix a pre-existing broken test-report artifact name that referenced
the undefined matrix.java_version (collided across all OS jobs); use
matrix.os to match the nativeCompile artifact naming.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* ci(build): use native-build-tools 0.11.5, drop JDK 25/Groovy bumps (COMP-1573)

The nativeCompile failure was not a JDK-too-old problem: native-build-tools
1.1.3 downloads the latest GraalVM reachability-metadata repository, which
uses the new unified reachability-metadata schema that GraalVM for JDK 21
(and 25.0.1) does not accept. Bumping the JDK could not fix it.

native-build-tools 0.11.x supports Gradle 9 (needed for the shadow 9.x
migration) but still uses the legacy metadata-repository schema that
GraalVM 21 accepts. Downgrading 1.1.3 -> 0.11.5 removes the schema
mismatch with the metadata repository left enabled.

This lets us revert the collateral bumps that were only introduced to
chase the 1.1.3 schema:
- native-build-tools 1.1.3 -> 0.11.5
- Gradle toolchain + native launcher languageVersion 25 -> 21
- setup-graalvm / setup-java java-version 25 -> 21
- Groovy test deps 4.0.32 -> 4.0.24

Net toolchain (GraalVM/JDK 21, Groovy 4.0.24) now matches master; the only
new tool versions are shadow 9.5.0, Gradle 9.6.1, and native-build-tools
0.11.5. Retains the setup-graalvm SHA pinning and the test-report artifact
name fix.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: cristianrcv

.github/workflows/build.yml

@@ -37,15 +37,15 @@ jobs:
 
       - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
 
-      - uses: graalvm/setup-graalvm@v1
+      - uses: graalvm/setup-graalvm@cabbb10818fabc989d6dbd508e4846596d20dd2d # v1.6.0
         if: ${{ matrix.musl }}
         with:
           java-version: '21'
           github-token: ${{ secrets.GITHUB_TOKEN }}
           native-image-job-reports: 'true'
           native-image-musl: 'true'
 
-      - uses: graalvm/setup-graalvm@v1
+      - uses: graalvm/setup-graalvm@cabbb10818fabc989d6dbd508e4846596d20dd2d # v1.6.0
         if: ${{ !matrix.musl }}
         with:
           java-version: '21'
@@ -115,7 +115,7 @@ jobs:
         if: failure()
         uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:
-          name: test-reports-jdk-${{ matrix.java_version }}
+          name: test-reports-${{ matrix.os }}
           path: |
             **/build/reports/tests/test
   release:

.github/workflows/security-submit-dependecy-graph.yml

@@ -11,7 +11,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
     - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
-    - uses: graalvm/setup-graalvm@v1
+    - uses: graalvm/setup-graalvm@cabbb10818fabc989d6dbd508e4846596d20dd2d # v1.6.0
       with:
         java-version: 21
 

app/build.gradle

@@ -1,8 +1,8 @@
 plugins {
     id 'groovy'
     id 'io.seqera.wave.cli.java-application-conventions'
-    id 'org.graalvm.buildtools.native' version '0.10.6'
-    id 'com.github.johnrengelman.shadow' version '8.1.1'
+    id 'org.graalvm.buildtools.native' version '0.11.5'
+    id 'com.gradleup.shadow' version '9.5.0'
 }
 
 java {

gradle/wrapper/gradle-wrapper.properties

@@ -17,7 +17,7 @@
 
 distributionBase=GRADLE_USER_HOME
 distributionPath=wrapper/dists
-distributionUrl=https\://services.gradle.org/distributions/gradle-8.13-bin.zip
+distributionUrl=https\://services.gradle.org/distributions/gradle-9.6.1-bin.zip
 networkTimeout=10000
 zipStoreBase=GRADLE_USER_HOME
 zipStorePath=wrapper/dists