ci(build): use native-build-tools 0.11.5, drop JDK 25/Groovy bumps (COMP-1573)

The nativeCompile failure was not a JDK-too-old problem: native-build-tools
1.1.3 downloads the latest GraalVM reachability-metadata repository, which
uses the new unified reachability-metadata schema that GraalVM for JDK 21
(and 25.0.1) does not accept. Bumping the JDK could not fix it.

native-build-tools 0.11.x supports Gradle 9 (needed for the shadow 9.x
migration) but still uses the legacy metadata-repository schema that
GraalVM 21 accepts. Downgrading 1.1.3 -> 0.11.5 removes the schema
mismatch with the metadata repository left enabled.

This lets us revert the collateral bumps that were only introduced to
chase the 1.1.3 schema:
- native-build-tools 1.1.3 -> 0.11.5
- Gradle toolchain + native launcher languageVersion 25 -> 21
- setup-graalvm / setup-java java-version 25 -> 21
- Groovy test deps 4.0.32 -> 4.0.24

Net toolchain (GraalVM/JDK 21, Groovy 4.0.24) now matches master; the only
new tool versions are shadow 9.5.0, Gradle 9.6.1, and native-build-tools
0.11.5. Retains the setup-graalvm SHA pinning and the test-report artifact
name fix.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: cristianrcv

.github/workflows/build.yml

@@ -40,15 +40,15 @@ jobs:
       - uses: graalvm/setup-graalvm@cabbb10818fabc989d6dbd508e4846596d20dd2d # v1.6.0
         if: ${{ matrix.musl }}
         with:
-          java-version: '25'
+          java-version: '21'
           github-token: ${{ secrets.GITHUB_TOKEN }}
           native-image-job-reports: 'true'
           native-image-musl: 'true'
 
       - uses: graalvm/setup-graalvm@cabbb10818fabc989d6dbd508e4846596d20dd2d # v1.6.0
         if: ${{ !matrix.musl }}
         with:
-          java-version: '25'
+          java-version: '21'
           github-token: ${{ secrets.GITHUB_TOKEN }}
           native-image-job-reports: 'true'
 
@@ -138,7 +138,7 @@ jobs:
       - name: Setup Java for JReleaser
         uses: actions/setup-java@c1e323688fd81a25caa38c78aa6df2d33d3e20d9 # v4.8.0
         with:
-          java-version: '25'
+          java-version: '21'
           distribution: 'adopt'
 
       - name: Version

.github/workflows/security-submit-dependecy-graph.yml

@@ -13,7 +13,7 @@ jobs:
     - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
     - uses: graalvm/setup-graalvm@cabbb10818fabc989d6dbd508e4846596d20dd2d # v1.6.0
       with:
-        java-version: 25
+        java-version: 21
 
     - name: Generate and submit dependency graph for wave-cli
       uses: gradle/actions/dependency-submission@748248ddd2a24f49513d8f472f81c3a07d4d50e1 # v4.4.4

CLAUDE.md

@@ -12,7 +12,7 @@ Wave CLI is a command-line tool for the Wave container provisioning service. It
 - Mirror containers between registries
 - Scan containers for security vulnerabilities
 
-The CLI is built using Java 17 (with Java 25 toolchain) and compiles to a native binary using GraalVM.
+The CLI is built using Java 17 (with Java 21 toolchain) and compiles to a native binary using GraalVM.
 
 ## Architecture
 
@@ -81,7 +81,7 @@ The project compiles to a native binary with specific configuration:
 
 ### Native Compilation
 ```bash
-# Build native binary (requires GraalVM Java 25)
+# Build native binary (requires GraalVM Java 21)
 ./gradlew app:nativeCompile
 
 # Run the native binary

app/build.gradle

@@ -1,13 +1,13 @@
 plugins {
     id 'groovy'
     id 'io.seqera.wave.cli.java-application-conventions'
-    id 'org.graalvm.buildtools.native' version '1.1.3'
+    id 'org.graalvm.buildtools.native' version '0.11.5'
     id 'com.gradleup.shadow' version '9.5.0'
 }
 
 java {
     toolchain {
-        languageVersion = JavaLanguageVersion.of(25)
+        languageVersion = JavaLanguageVersion.of(21)
     }
     sourceCompatibility = 17
     targetCompatibility = 17
@@ -32,10 +32,10 @@ dependencies {
     // bump commons-io version to address security vulnerabilities
     runtimeOnly 'commons-io:commons-io:2.18.0'
 
-    testImplementation "org.apache.groovy:groovy:4.0.32"
-    testImplementation "org.apache.groovy:groovy-nio:4.0.32"
-    testImplementation "org.apache.groovy:groovy-test:4.0.32"
-    testImplementation "org.apache.groovy:groovy-json:4.0.32"
+    testImplementation "org.apache.groovy:groovy:4.0.24"
+    testImplementation "org.apache.groovy:groovy-nio:4.0.24"
+    testImplementation "org.apache.groovy:groovy-test:4.0.24"
+    testImplementation "org.apache.groovy:groovy-json:4.0.24"
     testImplementation "net.bytebuddy:byte-buddy:1.14.11"
     testImplementation ("org.spockframework:spock-core:2.4-groovy-4.0") { exclude group: 'org.apache.groovy' }
 }
@@ -96,7 +96,7 @@ graalvmNative {
             }
 
             javaLauncher = javaToolchains.launcherFor {
-                languageVersion = JavaLanguageVersion.of(25)
+                languageVersion = JavaLanguageVersion.of(21)
                 vendor = JvmVendorSpec.matching("Oracle Corporation")
             }
             buildArgs.add('--enable-url-protocols=https')