[I] Enable PMD incrementally across remaining core modules [grails-core]

["jamesfredley (via GitHub)" <gi...@apache.org>]

jamesfredley opened a new issue, #16017:
URL: https://github.com/apache/grails-core/issues/16017

   ## Summary
   
   A full root PMD baseline with PMD 7.25.0 produced 5,603 findings across 53 source-bearing subprojects. Seven subprojects are clean today and can be protected immediately; the remaining modules need incremental cleanup before joining the blocking allowlist.
   
   ## Reproduction
   
   ```shell
   ./gradlew aggregateAnalysisViolations --continue \
     -Pgrails.code-analysis.enabled.pmd=true \
     -Pgrails.code-analysis.ignoreFailures=true
   ```
   
   Reports are written under `build/reports/code-analysis/pmd/`.
   
   ## Baseline
   
   Largest current groups:
   
   | Project | Findings |
   |---------|---------:|
   | `grails-core` | 699 |
   | `grails-datastore-core` | 698 |
   | `grails-web-common` | 585 |
   | `grails-data-hibernate5-core` | 549 |
   | `grails-gsp-core` | 289 |
   | `grails-data-mongodb-core` | 288 |
   | `grails-encoder` | 269 |
   | `grails-datamapping-core` | 254 |
   | `grails-converters` | 213 |
   | `grails-web-url-mappings` | 211 |
   | Remaining 43 projects | 1,548 |
   | **Total** | **5,603** |
   
   The current clean baseline is:
   
   - `:grails-data-graphql-core`
   - `:grails-data-mongodb-spring-data`
   - `:grails-datasource`
   - `:grails-scaffolding`
   - `:grails-spring-security`
   - `:grails-spring-security-acl`
   - `:grails-testing-support-core`
   
   ## Suggested approach
   
   Clean one independently buildable subproject at a time. After a subproject reaches zero findings, add its full project path to `grails.code-analysis.enabled.pmd.projects` so regressions become blocking immediately.
   
   Do not disable PMD rules globally to clear this backlog. If a rule is invalid for Grails/Groovy-generated Java, document and scope that exception to the affected source set or file pattern.
   
   ## Acceptance criteria
   
   - Each remaining source-bearing root subproject has zero PMD findings.
   - Each cleaned subproject is added to the PMD project allowlist in the same change.
   - Module tests and `aggregateAnalysisViolations` pass after every staged addition.
   


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: notifications-unsubscribe@grails.apache.org.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org