chore: Maintenance for 3.1.1 (Fix CME, update wrapper, secure test deps, clean build script) (#409)

* Fix `ConcurrentModificationException`: Eagerly evaluates configurations to a static list (`.toList()`) in `CheckSnapshotDependencies.groovy`. This prevents crashes when using the plugin alongside frameworks (like Quarkus 3.25.1+) that dynamically mutate configurations during evaluation. (Fixes #406)
* Build Script Modernization:
  * Removed legacy `buildscript` block and resolved plugin version conflicts.
  * Replaced deprecated `testCompile` with `testImplementation`.
  * Explicitly set `sourceCompatibility` and `targetCompatibility` to `1.8` to safeguard Java 8 baseline compatibility.
* Update Test Dependencies: Bumped `guava` to `32.0.1-jre` to resolve known CVEs in the test harness.
* Matrix & Runner Changes:
   * Expanded testing matrix to cover Gradle 6-9 across Java 8, 11, 17, and 21.
   * Configured CI to build always build the plugin with Java 8, while testing against the full matrix of Java versions via Gradle Toolchains.
   * Fixed artifact naming conflicts in the matrix to ensure consolidated JUnit reporting.

Author: haeusler

.github/workflows/junit_report.yml

@@ -14,7 +14,8 @@ jobs:
       - name: Download Test Report
         uses: dawidd6/action-download-artifact@v19
         with:
-          name: junit-test-results
+          name: junit-test-results-.*
+          name_is_regexp: true
           workflow: ${{ github.event.workflow.id }}
           run_id: ${{ github.event.workflow_run.id }}
       - name: Publish Test Report

.github/workflows/tests.yaml

@@ -13,23 +13,40 @@ jobs:
       fail-fast: false
       matrix:
         include:
+          # Gradle 6
           - java-version: '8'
             gradle-version: '6.9.4'
+          - java-version: '11'
+            gradle-version: '6.9.4'
+
+          # Gradle 7
           - java-version: '8'
             gradle-version: '7.6.6'
-          - java-version: '8'
+          - java-version: '11'
+            gradle-version: '7.6.6'
+
+          # Gradle 8
+          - java-version: '11'
             gradle-version: '8.14.4'
           - java-version: '17'
+            gradle-version: '8.14.4'
+
+          # Gradle 9 (Upcoming/Modern)
+          - java-version: '17'
+            gradle-version: '9.4.1'
+          - java-version: '21'
             gradle-version: '9.4.1'
 
     steps:
       - name: Checkout
         uses: actions/checkout@v6
 
-      - name: Set up JDK ${{ matrix.java-version }}
+      - name: Set up JDKs
         uses: actions/setup-java@v5
         with:
-          java-version: 8
+          java-version: |
+            ${{ matrix.java-version }}
+            8
           distribution: temurin
           architecture: x64
 
@@ -49,6 +66,6 @@ jobs:
         uses: actions/upload-artifact@v7
         if: always() # always run even if the previous step fails
         with:
-          name: junit-test-results-${{ matrix.gradle-version }}
+          name: junit-test-results-${{ matrix.gradle-version }}-${{ matrix.java-version }}
           path: '**/build/test-results/test/TEST-*.xml'
           retention-days: 1

build.gradle

@@ -1,29 +1,18 @@
 
-buildscript {
-    repositories {
-        maven {
-            url "https://plugins.gradle.org/m2/"
-        }
-    }
-    dependencies {
-        classpath 'nu.studer:gradle-plugindev-plugin:4.1'
-        classpath 'org.codehaus.groovy:groovy-backports-compat23:2.4.6'
-        classpath 'net.researchgate:gradle-release:2.7.0'
-    }
-}
-
 plugins {
-    id 'org.gradle.java-gradle-plugin'
-    id 'org.gradle.groovy'
+    id 'java-gradle-plugin'
+    id 'groovy'
     id 'maven-publish'
-    id 'net.researchgate.release' version '2.8.0'
+    id 'idea'
+    id 'net.researchgate.release' version '3.1.0'
     id 'com.gradle.plugin-publish' version '0.18.0'
 }
 
-apply plugin: 'idea'
-
 group='net.researchgate'
 
+sourceCompatibility = 1.8
+targetCompatibility = 1.8
+
 repositories {
     mavenCentral()
 }
@@ -32,10 +21,9 @@ dependencies {
     testImplementation("org.spockframework:spock-core:2.3-groovy-2.5") { exclude group: 'org.codehaus.groovy' }
     testImplementation "org.eclipse.jgit:org.eclipse.jgit:5.0.3.201809091024-r"
     testImplementation "cglib:cglib-nodep:3.2.8"
+    testImplementation("org.junit.jupiter:junit-jupiter:5.10.2")
     testImplementation gradleTestKit()
-    testImplementation("org.junit.jupiter:junit-jupiter:5.7.1")
-
-    testRuntimeOnly('com.google.guava:guava:27.1-android')
+    testRuntimeOnly('com.google.guava:guava:32.0.1-jre')
 }
 
 gradlePlugin {
@@ -74,7 +62,7 @@ processResources.duplicatesStrategy = DuplicatesStrategy.EXCLUDE
 
 release {
     git {
-        requireBranch = '(main|\\d+\\.\\d+)'
+        requireBranch.set('(main|\\d+\\.\\d+)')
     }
 }
 

gradle/wrapper/gradle-wrapper.properties

@@ -1,6 +1,7 @@
 distributionBase=GRADLE_USER_HOME
 distributionPath=wrapper/dists
-distributionUrl=https\://services.gradle.org/distributions/gradle-6.9.4-bin.zip
-distributionSha256Sum=3e240228538de9f18772a574e99a0ba959e83d6ef351014381acd9631781389a
+distributionUrl=https\://services.gradle.org/distributions/gradle-6.9.4-all.zip
 zipStoreBase=GRADLE_USER_HOME
 zipStorePath=wrapper/dists
+distributionSha256Sum=84b50e7b380e9dc9bbc81e30a8eb45371527010cf670199596c86875f774b8b0
+

src/main/groovy/net/researchgate/release/tasks/CheckSnapshotDependencies.groovy

@@ -22,10 +22,10 @@ class CheckSnapshotDependencies extends BaseReleaseTask {
 
         project.allprojects.each { project ->
             def snapshotDependencies = [] as Set
-            project.configurations.each { cfg ->
+            project.configurations.toList().each { cfg ->
                 snapshotDependencies += cfg.dependencies?.matching(matcher)?.collect(collector)
             }
-            project.buildscript.configurations.each { cfg ->
+            project.buildscript.configurations.toList().each { cfg ->
                 snapshotDependencies += cfg.dependencies?.matching(matcher)?.collect(collector)
             }
             if (snapshotDependencies.size() > 0) {