You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@grails.apache.org by ja...@apache.org on 2026/04/30 21:31:10 UTC
(grails-static-website) 01/01: Phase 5 toolchain bootstrap: buildSrc deps + scripts/ dir (refs #354)
This is an automated email from the ASF dual-hosted git repository.
jamesfredley pushed a commit to branch phase-5-toolchain-bootstrap
in repository https://gitbox.apache.org/repos/asf/grails-static-website.git
commit 7b26077553db98aac0e8a100d3903d468780dcce
Author: James Fredley <ja...@users.noreply.github.com>
AuthorDate: Thu Apr 30 17:31:04 2026 -0400
Phase 5 toolchain bootstrap: buildSrc deps + scripts/ dir (refs #354)
Set up the build-time dependencies and operational-script directory the
later migration phases need. Three discrete fixes:
(5a) buildSrc dependencies
Add to buildSrc/build.gradle for Phase 7-9 work:
org.asciidoctor:asciidoctorj:2.5.13 - Phase 7-8 IncludeProcessor
+ AsciiDoc parsing for include::
vendoring during Phase 9 spike
and Phase 10 bulk migration
org.jsoup:jsoup:1.18.1 - Phase 9 verification harness
(HTML parsing + assertions on
rendered guide pages)
Pin SnakeYAML explicitly:
org.yaml:snakeyaml:2.3 - was previously transitive-
unversioned via Micronaut BOM;
explicit pin >= 2.0 mitigates
CVE-2022-1471
Add the Grails Foundation maven repository so later phases can pull
grails-docs (deferred -- see note below):
maven { url = 'https://repo.grails.org/grails/core' }
NOTE: org.grails:grails-docs:6.2.0 was originally planned for this
phase too. It transitively brings org.codehaus.groovy:groovy:3.0.21
which conflicts with this buildSrc's Apache Groovy 4.0.x classpath
(used by Spock 4.0+). It will be added in Phase 7 alongside the
PublishGuide integration that actually consumes it, with capability
resolution to handle the Groovy 3 -> 4 conflict.
(5b) scripts/ directory
Create scripts/.gitkeep + scripts/README.md.
The README documents:
* which migration phase contributes which script
* required external tooling (gh, yq, JDK 17+, rsync) and where
each is consumed
* optional tooling (Playwright) for the optional Phase 9 visual-diff path
(5c) Tooling prerequisites
Captured inline in scripts/README.md per the plan. The matrix lists
each tool, why it is needed, and which phase first needs it.
## Verification
./gradlew -p buildSrc test => BUILD SUCCESSFUL (exit 0)
SoftwareVersionSpec passes with new deps
on classpath; no resolution conflicts.
./gradlew clean build => BUILD SUCCESSFUL (exit 0)
17 actionable tasks, all green.
Resolved versions in :buildSrc:runtimeClasspath:
org.yaml:snakeyaml:2.3 -> 2.4 (BOM transitive upgrade, still safe)
org.asciidoctor:asciidoctorj:2.5.13 -> 3.0.0 (BOM transitive upgrade)
org.jsoup:jsoup:1.18.1 -> 1.21.2 (BOM transitive upgrade)
All resolved versions are >= the explicit pins; no downgrades and no
CVE-2022-1471 SnakeYAML versions present.
Refs apache/grails-static-website#354
Assisted-by: claude-code:claude-4.6-opus
---
buildSrc/build.gradle | 24 ++++++++++++++++-
scripts/.gitkeep | 0
scripts/README.md | 73 +++++++++++++++++++++++++++++++++++++++++++++++++++
3 files changed, 96 insertions(+), 1 deletion(-)
diff --git a/buildSrc/build.gradle b/buildSrc/build.gradle
index b70f0c9de7f..6edcfce5a88 100644
--- a/buildSrc/build.gradle
+++ b/buildSrc/build.gradle
@@ -9,6 +9,10 @@ ext {
repositories {
mavenCentral()
+ // Phase 5 (refs #354): repo.grails.org is needed for grails-docs and any
+ // other Grails Foundation artifacts wired in later phases (e.g. when
+ // PublishGuide is integrated in Phase 7-8).
+ maven { url = 'https://repo.grails.org/grails/core' }
}
dependencies {
@@ -20,7 +24,25 @@ dependencies {
implementation 'io.micronaut.rss:micronaut-rss-core'
implementation 'io.micronaut.validation:micronaut-validation'
implementation 'jakarta.annotation:jakarta.annotation-api'
- implementation 'org.yaml:snakeyaml'
+
+ // Phase 5 (refs #354): explicit pin >= 2.0 to mitigate CVE-2022-1471
+ // (was previously transitive-unversioned via Micronaut BOM).
+ implementation 'org.yaml:snakeyaml:2.3'
+
+ // Phase 7-8 (refs #354): AsciiDoctor + custom IncludeProcessor for the
+ // include:: vendoring done during Phase 9 spike + Phase 10 bulk migration.
+ implementation 'org.asciidoctor:asciidoctorj:2.5.13'
+
+ // Phase 9 (refs #354): Jsoup for the verification harness (HTML parsing
+ // + assertions on rendered guide pages).
+ implementation 'org.jsoup:jsoup:1.18.1'
+
+ // NOTE (refs #354): grails-docs:6.2.0 was originally planned to land in
+ // Phase 5 too, but it transitively brings Groovy 3.0.21 (org.codehaus.groovy)
+ // which conflicts with this buildSrc's Apache Groovy 4.0.x classpath
+ // (used by Spock 4.0+). It will be added in Phase 7 alongside the
+ // PublishGuide integration that actually consumes it, with capability
+ // resolution to handle the Groovy 3 -> 4 conflict.
testImplementation 'org.spockframework:spock-core'
diff --git a/scripts/.gitkeep b/scripts/.gitkeep
new file mode 100644
index 00000000000..e69de29bb2d
diff --git a/scripts/README.md b/scripts/README.md
new file mode 100644
index 00000000000..5858475a93f
--- /dev/null
+++ b/scripts/README.md
@@ -0,0 +1,73 @@
+<!--
+SPDX-License-Identifier: Apache-2.0
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+ https://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+-->
+
+# scripts/
+
+Operational scripts for the apache/grails-static-website#354 publishing
+migration and routine maintenance.
+
+This directory is created in Phase 5 (refs #354). It is currently empty;
+each later phase contributes scripts here as needed:
+
+| Phase | Expected scripts |
+|---|---|
+| Phase 7 | Schema validator runner (`-PvalidationMode=shape\|existence\|both`) |
+| Phase 9 | Per-spike-guide migration helper (vendoring `complete/` snippets) |
+| Phase 10 | Bulk migration driver (consumes `.sisyphus/plans/triage-decisions.yml` + `guide-inventory.yml`) |
+| Phase 11 | Verification harness CLI (warning regex, schema, CSP, URL audit) |
+| Phase 14 | Per-repo strip + archive helper |
+| Phase 15 | Redirect-stub generator (consumes `freeze-baseline-paths.txt`) |
+
+## Required tooling
+
+The migration scripts assume the following are available on the operator's
+machine. CI runners install them automatically; local development needs them
+installed manually.
+
+| Tool | Purpose | Where used |
+|---|---|---|
+| `gh` (GitHub CLI), authenticated as a repo admin | API calls, PR creation, branch protection management | All migration phases |
+| `yq` (the Mike Farah Go version, NOT the Python version) | Parse `.sisyphus/plans/*.yml` deliverables in shell scripts | Phase 7+ |
+| JDK 17+ | Build target. JDK 19+ also enables the bundled `jwebserver` for local serving | Default build |
+| `rsync` (Ubuntu CI default; `brew install rsync` on macOS) | `publish.sh` mirror semantics | CI deploy step |
+| `git` | Repo operations | All phases |
+
+Optional, only for the OPTIONAL Phase 9 visual-diff path:
+
+| Tool | Purpose |
+|---|---|
+| Playwright (Java or Node) | Visual diff of legacy vs migrated guide pages |
+
+## Running a script from this directory
+
+Scripts are POSIX shell unless otherwise noted. Standard invocation:
+
+```bash
+./scripts/<name>.sh [args]
+```
+
+Per-script docs at the top of each file describe its arguments and
+preconditions. Phase 11 will add a single `verify-harness.sh` that runs the
+full verification suite in one invocation.
+
+## Why this directory exists
+
+Several migration phases (7, 9, 10, 11, 14, 15) need automation that
+operates on the live grails-guides org or on the migration deliverables in
+`.sisyphus/plans/`. Centralizing those scripts here keeps them reviewable,
+versioned, and easy to find when running rollback or re-execution. See
+`.sisyphus/plans/issue-354-publishing-migration-v7.md` for the full
+sequence.