ci(build): bump JDK toolchain to 25 to fix native compile (COMP-1573)

The shadow-plugin migration for the log4j fix pulled in Gradle 9 and
native-build-tools 1.1.3, whose GraalVM reachability-metadata repository
requires a newer reachability-metadata schema than GraalVM for JDK 21
provides. CI `nativeCompile` failed on that schema mismatch.

Bump the build toolchain to JDK 25 across the repo so the GraalVM
reachability metadata schema is supported:
- setup-graalvm / setup-java java-version 21 -> 25 in build.yml and
  security-submit-dependecy-graph.yml
- Gradle toolchain and native launcher languageVersion 21 -> 25
- Groovy test deps 4.0.24 -> 4.0.32 (4.0.24 cannot compile against JDK 25
  class files: "Unsupported class file major version 69")

sourceCompatibility/targetCompatibility stay at 17, so the shipped fat
jar still runs on JRE 17+.

Also fix a pre-existing broken test-report artifact name that referenced
the undefined matrix.java_version (collided across all OS jobs); use
matrix.os to match the nativeCompile artifact naming.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: cristianrcv

.github/workflows/build.yml

@@ -40,15 +40,15 @@ jobs:
       - uses: graalvm/setup-graalvm@cabbb10818fabc989d6dbd508e4846596d20dd2d # v1.6.0
         if: ${{ matrix.musl }}
         with:
-          java-version: '21'
+          java-version: '25'
           github-token: ${{ secrets.GITHUB_TOKEN }}
           native-image-job-reports: 'true'
           native-image-musl: 'true'
 
       - uses: graalvm/setup-graalvm@cabbb10818fabc989d6dbd508e4846596d20dd2d # v1.6.0
         if: ${{ !matrix.musl }}
         with:
-          java-version: '21'
+          java-version: '25'
           github-token: ${{ secrets.GITHUB_TOKEN }}
           native-image-job-reports: 'true'
 
@@ -115,7 +115,7 @@ jobs:
         if: failure()
         uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:
-          name: test-reports-jdk-${{ matrix.java_version }}
+          name: test-reports-${{ matrix.os }}
           path: |
             **/build/reports/tests/test
   release:
@@ -138,7 +138,7 @@ jobs:
       - name: Setup Java for JReleaser
         uses: actions/setup-java@c1e323688fd81a25caa38c78aa6df2d33d3e20d9 # v4.8.0
         with:
-          java-version: '21'
+          java-version: '25'
           distribution: 'adopt'
 
       - name: Version

.github/workflows/security-submit-dependecy-graph.yml

@@ -13,7 +13,7 @@ jobs:
     - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
     - uses: graalvm/setup-graalvm@cabbb10818fabc989d6dbd508e4846596d20dd2d # v1.6.0
       with:
-        java-version: 21
+        java-version: 25
 
     - name: Generate and submit dependency graph for wave-cli
       uses: gradle/actions/dependency-submission@748248ddd2a24f49513d8f472f81c3a07d4d50e1 # v4.4.4

CLAUDE.md

@@ -12,7 +12,7 @@ Wave CLI is a command-line tool for the Wave container provisioning service. It
 - Mirror containers between registries
 - Scan containers for security vulnerabilities
 
-The CLI is built using Java 17 (with Java 21 toolchain) and compiles to a native binary using GraalVM.
+The CLI is built using Java 17 (with Java 25 toolchain) and compiles to a native binary using GraalVM.
 
 ## Architecture
 
@@ -81,7 +81,7 @@ The project compiles to a native binary with specific configuration:
 
 ### Native Compilation
 ```bash
-# Build native binary (requires GraalVM Java 21)
+# Build native binary (requires GraalVM Java 25)
 ./gradlew app:nativeCompile
 
 # Run the native binary

app/build.gradle

@@ -7,7 +7,7 @@ plugins {
 
 java {
     toolchain {
-        languageVersion = JavaLanguageVersion.of(21)
+        languageVersion = JavaLanguageVersion.of(25)
     }
     sourceCompatibility = 17
     targetCompatibility = 17
@@ -32,10 +32,10 @@ dependencies {
     // bump commons-io version to address security vulnerabilities
     runtimeOnly 'commons-io:commons-io:2.18.0'
 
-    testImplementation "org.apache.groovy:groovy:4.0.24"
-    testImplementation "org.apache.groovy:groovy-nio:4.0.24"
-    testImplementation "org.apache.groovy:groovy-test:4.0.24"
-    testImplementation "org.apache.groovy:groovy-json:4.0.24"
+    testImplementation "org.apache.groovy:groovy:4.0.32"
+    testImplementation "org.apache.groovy:groovy-nio:4.0.32"
+    testImplementation "org.apache.groovy:groovy-test:4.0.32"
+    testImplementation "org.apache.groovy:groovy-json:4.0.32"
     testImplementation "net.bytebuddy:byte-buddy:1.14.11"
     testImplementation ("org.spockframework:spock-core:2.4-groovy-4.0") { exclude group: 'org.apache.groovy' }
 }
@@ -96,7 +96,7 @@ graalvmNative {
             }
 
             javaLauncher = javaToolchains.launcherFor {
-                languageVersion = JavaLanguageVersion.of(21)
+                languageVersion = JavaLanguageVersion.of(25)
                 vendor = JvmVendorSpec.matching("Oracle Corporation")
             }
             buildArgs.add('--enable-url-protocols=https')