Development: Replace deprecated Gradle build APIs

[krusche]

Summary

Replace deprecated Gradle APIs in SBOM staging and test reporting, and use the current dependency-versions plugin ID. SBOM opt-in and stale-resource cleanup retain their existing behavior; test totals still print after the suite finishes.

Checklist

• Tested the build-script changes locally.
• Followed the repository's naming and language conventions.
• Independent review and test-server confirmation.

Motivation and Context

The develop warning audit found APIs scheduled for removal in Gradle 10. This change addresses the locally owned build-script warnings. The remaining Project.container(Class, Closure) warning originates in org.liquibase.gradle.LiquibasePlugin.doApplyExtension in the already-current 3.1.0 plugin; migrating or patching that plugin is outside this small cleanup.

Description

• Switch to io.github.ben-manes.versions without changing its version.
• Assign CycloneDX's application enum explicitly on the plugin-visible build-script classpath.
• Capture the SBOM mode and paths during configuration, and use injected FileSystemOperations for execution-time copying.
• Replace afterTest/afterSuite closure registration with TestListener, preserving failure collection and the final summary.

Steps for Testing

1. Run ./gradlew help copySbomsToResources checkstyleMain -x webapp --warning-mode all.
2. Run ./gradlew test --tests '*UnionFindTest' -x webapp --warning-mode all; verify the final test-total summary.
3. Stage server/client SBOM fixtures with -Pprod -Psbom, excluding generation tasks, and compare staged contents. Run without the flags and verify stale staged SBOMs are removed.

Validation

• Build configuration, default SBOM task and Checkstyle passed.
• UnionFind tests passed; final test summary printed.
• Isolated build-directory fixture check: both SBOMs copied byte-for-byte with both flags; staging directory removed without the flags.
• Only the upstream Liquibase configuration warning remains in the focused SBOM checks. Existing Java API warnings are unchanged.

Review Progress

• Code review
• Independent verification

[github-actions]

End-to-End Test Results

Phase	Status	Details
All Tests	❌ Failed	Tests Passed ☑️ Skipped ⚠️ Failed ❌️ Time ⏱ All E2E Tests Report (PR) 418 ran 407 passed 10 skipped 1 failed 33m 18s

❌ Failed Tests

• Retention-aware user deletion › previews not-enrolled users without deleting before confirmation (7s)

Test Strategy: Running all tests (configuration or infrastructure changes detected)

Overall: ❌ E2E: real (non-flaky) test failure

🔗 Workflow Run · 📊 Test Report

[coderabbitai]

Warning

Review limit reached

Next included review available in 8 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used all 4 included reviews currently available.

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Team

Run ID: 106fb53d-6ca2-4757-a807-46bfe0af28a5

📥 Commits

Reviewing files that changed from the base of the PR and between 5de2689 and 541f7ed.

📒 Files selected for processing (3)

• build.gradle
• gradle/sbom.gradle
• gradle/test.gradle

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[Copilot]

🔵 Needs a closer look

SBOM generation still hard-codes the build/ output path in one place, which can diverge from the new layout.buildDirectory-based paths and cause subtle staging failures if the build directory is customized.

Pull request overview

Replaces deprecated Gradle build-script APIs related to SBOM staging and test reporting to stay compatible with upcoming Gradle 10 removals, while preserving the existing SBOM opt-in behavior and end-of-suite test summary output.

Changes:

• Switched dependency-versions plugin ID to io.github.ben-manes.versions.
• Migrated test summary reporting from afterTest/afterSuite closures to a TestListener.
• Refactored SBOM staging to capture configuration-time paths and use injected FileSystemOperations for execution-time copying and cleanup.

File summaries

File	Description
gradle/test.gradle	Replaces deprecated afterTest/afterSuite wiring with a TestListener while keeping failure tracking + final summary output.
gradle/sbom.gradle	Introduces injected FileSystemOperations, centralizes SBOM enablement flag, and modernizes SBOM staging/cleanup path handling.
build.gradle	Updates dependency-versions plugin ID and sets CycloneDX projectType via enum on the main script classpath.

Review details

Suppressed comments (1)

gradle/sbom.gradle:23

• cyclonedxDirectBom writes jsonOutput to a hard-coded build/ path, but later the copy task reads the server SBOM via layout.buildDirectory. If the build directory is ever customized, the generator and copier will diverge; using layout.buildDirectory for jsonOutput keeps paths consistent and avoids hard-coding build/.

    skipConfigs = ["testCompileClasspath", "testRuntimeClasspath", "checkstyle", "mockitoAgent", "liquibaseRuntime"]
    includeBomSerialNumber = true
    includeLicenseText = false
    // Output configuration for v3.x - use file properties instead of destination/outputName/outputFormat
    jsonOutput = file("build/reports/sbom/server-sbom.json")

• Files reviewed: 2/3 changed files
• Comments generated: 0
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.