build.gradle

/*
 * PerlOnJava Build Configuration
 * This Gradle build script configures the build process for the PerlOnJava project
 */

buildscript {
    repositories {
        gradlePluginPortal()
        mavenCentral()
    }
}

// Core plugins configuration
plugins {
    id 'java'
    // Plugin for updating version catalog with latest versions (configuration cache compatible!)
    alias(libs.plugins.version.catalog.update)
    id 'application'
    // Plugin for creating OS packages (deb)
    alias(libs.plugins.ospackage)
    // Plugin for creating fat/uber JARs
    alias(libs.plugins.shadow)
    // Plugin for generating CycloneDX SBOM (Software Bill of Materials)
    alias(libs.plugins.cyclonedx)
}

// Main application class configuration
application {
    mainClass = 'org.perlonjava.app.cli.Main'
}

// Debian package build dependency
tasks.buildDeb {
    dependsOn installDist
}

// Copy custom wrapper scripts to installDist bin directory
tasks.register('copyWrapperScripts', Copy) {
    dependsOn installDist
    from(projectDir) {
        include 'jperl'
        include 'jperl.bat'
        include 'jcpan'
        include 'jcpan.bat'
        include 'jperldoc'
        include 'jperldoc.bat'
        include 'jprove'
        include 'jprove.bat'
    }
    into "${buildDir}/install/perlonjava/bin"
}

// Copy Perl bin scripts (cpan, perldoc, prove) to installDist bin directory
tasks.register('copyPerlBinScripts', Copy) {
    dependsOn installDist
    from('src/main/perl/bin') {
        include 'cpan'
        include 'perldoc'
        include 'prove'
    }
    into "${buildDir}/install/perlonjava/bin"
}

// Make buildDeb depend on both copy tasks
tasks.buildDeb {
    dependsOn copyWrapperScripts
    dependsOn copyPerlBinScripts
}

// Project metadata
group = 'org.perlonjava'
version = '5.44.1'

// CycloneDX SBOM generation configuration
cyclonedxBom {
    // Production runtime dependencies are the contents of the standalone JAR;
    // test and annotation configurations do not belong in the shipped SBOM.
    includeConfigs = ["runtimeClasspath"]
    projectType = "application"
    schemaVersion = "1.5"
    includeLicenseText = false
    includeBomSerialNumber = true
    outputName = "bom"
    outputFormat = "all"  // Generate both JSON and XML
    componentName = "perlonjava"
    componentVersion = project.version
    organizationalEntity = { oe ->
        oe.name = "PerlOnJava Project"
        oe.urls = ["https://github.com/fglock/PerlOnJava"]
    }
}

// Git info injection - injects commit ID and date into Configuration.java before compilation
// This ensures the built JAR contains accurate version information for -v output
//
// Configuration.java is NOT tracked by git (it is listed in .gitignore).
// The canonical template is Configuration.java.in, which is tracked and contains
// placeholder values.  Always regenerate from that template so version and other
// configuration changes cannot leave a stale generated source in an existing
// checkout, then patch in the real git hash, commit date, and build timestamp.
def configFilePath    = layout.projectDirectory.file('src/main/java/org/perlonjava/core/Configuration.java')
def configTemplPath   = layout.projectDirectory.file('src/main/java/org/perlonjava/core/Configuration.java.in')

tasks.register('injectGitInfo') {
    description = 'Regenerates Configuration.java from its template and injects build metadata'
    group = 'build'
    
    def configFile  = configFilePath.asFile
    def templateFile = configTemplPath.asFile

    inputs.file(configTemplPath)
    outputs.file(configFilePath)
    // The build timestamp and current git revision are dynamic inputs.
    outputs.upToDateWhen { false }
    
    doLast {
        if (!templateFile.exists()) {
            throw new GradleException("Configuration template not found: ${templateFile}")
        }

        // Never carry configuration values forward from a previous build.
        def content = templateFile.text
        
        // Get git commit info using Runtime.exec
        def gitCommitId = 'dev'
        def gitCommitDate = 'unknown'
        
        try {
            def commitIdProcess = ['git', 'rev-parse', '--short', 'HEAD'].execute()
            commitIdProcess.waitFor()
            if (commitIdProcess.exitValue() == 0) {
                gitCommitId = commitIdProcess.text.trim()
            }
            
            def commitDateProcess = ['git', 'log', '-1', '--format=%cs', 'HEAD'].execute()
            commitDateProcess.waitFor()
            if (commitDateProcess.exitValue() == 0) {
                gitCommitDate = commitDateProcess.text.trim()
            }
        } catch (Exception e) {
            logger.warn("Could not get git info: ${e.message}")
        }
        
        // Only update if we got valid values
        if (gitCommitId && gitCommitId != 'dev') {
            // Use safe pattern matching for quoted string values
            content = content.replaceAll(
                /(gitCommitId\s*=\s*)"[^"]*"/,
                "\$1\"${gitCommitId}\""
            )
            content = content.replaceAll(
                /(gitCommitDate\s*=\s*)"[^"]*"/,
                "\$1\"${gitCommitDate}\""
            )

            // Generate build timestamp in Perl 5 "Compiled at" format: "Mon DD YYYY HH:MM:SS"
            def now = new java.util.Date()
            def buildTimestamp = new java.text.SimpleDateFormat("MMM dd yyyy HH:mm:ss", java.util.Locale.ENGLISH).format(now)
            // Perl uses single-digit day with leading space (e.g., "Apr  7" not "Apr 07")
            buildTimestamp = buildTimestamp.replaceAll(/^(\w{3}) 0/, '$1  ')
            content = content.replaceAll(
                /(buildTimestamp\s*=\s*)"[^"]*"/,
                "\$1\"${buildTimestamp}\""
            )
        }

        configFile.text = content
        logger.lifecycle("Regenerated Configuration.java and injected git info: ${gitCommitId} (${gitCommitDate})")
    }
}

// Make compilation depend on git info injection
tasks.named('compileJava') {
    dependsOn 'injectGitInfo'
}

// OS package configuration for Debian packaging
ospackage {
    packageName = 'perlonjava'
    version = project.version
    maintainer = 'Flavio Soibelmann Glock <fglock@gmail.com>'
    // Java 24+ is required at runtime (any distribution: Oracle, Azul, Temurin, OpenJDK, etc.)

    into '/opt/perlonjava'
    from('build/install/perlonjava') {
        into '/opt/perlonjava'
    }
    
    // Include combined SBOM in the package
    from('build/reports') {
        into '/opt/perlonjava/share/sbom'
        include 'sbom.json'
    }

    link('/usr/local/bin/jperl', '/opt/perlonjava/bin/jperl')
    link('/usr/local/bin/jcpan', '/opt/perlonjava/bin/jcpan')
    link('/usr/local/bin/jperldoc', '/opt/perlonjava/bin/jperldoc')
    link('/usr/local/bin/jprove', '/opt/perlonjava/bin/jprove')
}

// Java toolchain configuration - requires Java 24
java {
    toolchain {
        languageVersion = JavaLanguageVersion.of(24)
    }
}

// Repository configuration
repositories {
    mavenCentral()
}

// Project dependencies
dependencies {
    // Core dependencies
    implementation libs.asm                           // ByteCode manipulation
    implementation libs.asm.util                      // ASM utilities
    implementation libs.icu4j                         // Unicode support
    implementation libs.jsoup                        // HTML5 parsing for HTML::Content::Extractor
    implementation libs.jing                         // RELAX NG validation for XML::LibXML
    implementation libs.snakeyaml.engine              // YAML processing
    implementation libs.tomlj                         // TOML processing
    implementation libs.zxing.core                    // QR encoding for Text::QRCode
    implementation libs.commons.csv                   // CSV processing
    implementation libs.commonmark                    // CommonMark rendering
    implementation libs.commonmark.autolink           // GFM autolinks
    implementation libs.commonmark.strikethrough      // GFM strikethrough
    implementation libs.commonmark.tables             // GFM tables
    implementation libs.commonmark.task.list          // GFM task lists
    implementation libs.commons.compress               // BZip2/tar/etc. compressors
    implementation libs.sqlite.jdbc                    // SQLite JDBC driver
    implementation libs.bcprov                         // Bouncy Castle crypto (SHA-3, Keccak, etc.)
    implementation libs.bcpkix                         // Bouncy Castle PEM/PKCS parsing
    implementation libs.snappy.java                    // Official Sereal Java codec compression
    implementation libs.zstd.jni                       // Official Sereal Java codec compression
    implementation 'org.jruby.jcodings:jcodings:1.0.64' // Encoding support for vendored Joni
    implementation 'io.netty:netty-codec-http:4.1.115.Final'  // Netty HTTP codec for PSGI server

    // Testing dependencies
    testImplementation libs.junit.jupiter.api
    testImplementation libs.junit.jupiter.engine
    testImplementation libs.junit.jupiter.params
}

// JUnit configuration
testing {
    suites {
        test {
            useJUnitJupiter()
        }
    }
}

// Java compilation settings
tasks.withType(JavaCompile).configureEach {
    options.compilerArgs << '-Xlint:-options'
    options.compilerArgs << '-Xlint:deprecation'
}

// Test execution configuration with native access and adequate heap
tasks.withType(Test).configureEach {
    jvmArgs += '--enable-native-access=ALL-UNNAMED'
    // PerlScriptExecutionTest runs Perl directly in the Gradle worker rather
    // than through jperl.bat. Match the launcher's recursion-safe stack size,
    // especially on Windows where the default worker stack is too small for
    // the 1000-call compatibility guard.
    jvmArgs += '-Xss16m'
    // Netty still uses the transitional sun.misc.Unsafe memory API. PerlOnJava
    // requires Java 24, where explicitly allowing it suppresses the terminal
    // deprecation banner while retaining the tested Netty allocation path.
    jvmArgs += '--sun-misc-unsafe-memory-access=allow'
    maxHeapSize = '1g'
}

// Enable native access for all Java execution tasks
allprojects {
    tasks.withType(JavaExec).configureEach {
        jvmArgs += '--enable-native-access=ALL-UNNAMED'
    }
}

// JUnit platform configuration - default test task runs only unit tests
test {
    useJUnitPlatform {
        includeTags 'unit'
        excludeTags 'full'
    }

    // Preserve the exact last-started test in CI logs if a platform-specific
    // child process blocks before Gradle can publish XML results.
    testLogging {
        events 'started', 'failed'
        exceptionFormat = 'full'
    }
}

// Propagate `JPERL_TEST_FILTER` into forked test JVMs as a plain string.
// Passing a Provider to `Test.systemProperty` / `environment` has been observed
// to stringify the Provider (breaking substring filters); resolve via the same
// Provider we already record as an input so configuration-cache invalidation
// stays correct when the env var changes between invocations.
def jperlTestFilterProp = providers.environmentVariable('JPERL_TEST_FILTER').orElse('')
tasks.withType(Test).configureEach { t ->
    t.inputs.property('jperlTestFilter', jperlTestFilterProp)
    t.environment('JPERL_TEST_FILTER', jperlTestFilterProp.get())
}

// Fast unit tests only (tests in unit/ directory)
tasks.register('testUnit', Test) {
    description = 'Runs fast unit tests only (from unit/ directory)'
    group = 'verification'
    
    useJUnitPlatform {
        includeTags 'unit'
        excludeTags 'full'
    }
    
    shouldRunAfter test
}

// All tests including comprehensive module tests
tasks.register('testAll', Test) {
    description = 'Runs all tests including comprehensive module tests'
    group = 'verification'
    
    useJUnitPlatform {
        includeTags 'full'
    }
    
    shouldRunAfter testUnit
}

// Focused shell-independent thread gate for Windows CI. The Linux release
// matrix additionally runs the unchanged upstream Perl distributions.
tasks.register('testThreadsWindows', Test) {
    description = 'Runs deterministic Perl thread/runtime tests on Windows CI'
    group = 'verification'

    testClassesDirs = sourceSets.test.output.classesDirs
    classpath = sourceSets.test.runtimeClasspath

    useJUnitPlatform {
        includeTags 'unit'
        excludeTags 'full'
    }

    include '**/PerlThread*Test.class'
    include '**/ThreadCompiledCodeIdRangeTest.class'
    include '**/SharedPerlStorage*Test.class'
    include '**/PerlRuntimeSnapshotTest.class'
    include '**/PerlRuntimeStashSnapshotTest.class'
    include '**/RuntimeGraphCloner*Test.class'
    include '**/DBIHandleResourceThreadTest.class'
}

// Bundled module tests (XML::Parser, etc.)
// Tests live under src/test/resources/module/{ModuleName}/t/
tasks.register('testModule', Test) {
    description = 'Runs bundled CPAN module tests (e.g. XML::Parser)'
    group = 'verification'
    
    testClassesDirs = sourceSets.test.output.classesDirs
    classpath = sourceSets.test.runtimeClasspath
    
    useJUnitPlatform {
        includeTags 'module'
    }

    // Tests that spawn a child perl (via $^X, e.g. System::Command)
    // need PERLONJAVA_EXECUTABLE set to a real launcher, since under
    // Gradle "jperl" isn't on $PATH. GlobalContext reads this env var
    // when initializing $^X.
    def jperlLauncher = org.gradle.internal.os.OperatingSystem.current().isWindows()
            ? "jperl.bat" : "jperl"
    environment 'PERLONJAVA_EXECUTABLE', file(jperlLauncher).absolutePath

    shouldRunAfter testUnit
}

// Shadow JAR configuration for creating standalone executable
shadowJar {
    archiveClassifier.set('')
    destinationDirectory = file("$buildDir/../target")
    manifest {
        attributes 'Main-Class': 'org.perlonjava.app.cli.Main'
    }
    exclude 'module-info.class'
    exclude 'META-INF/MANIFEST.MF'

    // Keep the embedded regex engine private when PerlOnJava shares a
    // classpath with JRuby or another Joni/JCodings version.
    // JCodings supplies a CharsetProvider through ServiceLoader.  Relocation
    // changes its class name, so transform its service descriptor as well.
    mergeServiceFiles()
    relocate 'org.joni', 'org.perlonjava.internal.joni'
    relocate 'org.jcodings', 'org.perlonjava.internal.jcodings'

    from('third_party/joni/LICENSE') {
        into 'META-INF/licenses'
        rename { 'joni-LICENSE.txt' }
    }
    from('third_party/licenses/jcodings-LICENSE.txt') {
        into 'META-INF/licenses'
    }
    from('third_party/joni/PERLONJAVA-NOTICE.md') {
        into 'META-INF/licenses'
        rename { 'joni-PERLONJAVA-NOTICE.md' }
    }
    
    // Include combined SBOM in JAR's META-INF/sbom/ directory
    from("$buildDir/reports/sbom.json") {
        into 'META-INF/sbom'
    }
}

// The application plugin normally installs the thin project JAR together with
// every runtime dependency.  That would reintroduce the public org.joni and
// org.jcodings namespaces even though the standalone JAR relocates both.  Use
// the standalone artifact as the complete installed runtime classpath instead.
def standaloneRuntimeJar = tasks.named('shadowJar').flatMap { it.archiveFile }
def distributionLicenseDirectory = 'share/licenses'

tasks.named('startScripts') {
    dependsOn shadowJar
    classpath = files(standaloneRuntimeJar)
}

tasks.named('installDist') {
    dependsOn shadowJar

    from(standaloneRuntimeJar) {
        into 'lib'
    }
    from('third_party/joni/LICENSE') {
        into distributionLicenseDirectory
        rename { 'joni-LICENSE.txt' }
    }
    from('third_party/licenses/jcodings-LICENSE.txt') {
        into distributionLicenseDirectory
    }
    from('third_party/joni/PERLONJAVA-NOTICE.md') {
        into distributionLicenseDirectory
        rename { 'joni-PERLONJAVA-NOTICE.md' }
    }

    // Retain only the relocated standalone artifact under lib/.  Comparing
    // source paths (rather than names) matters because the thin and standalone
    // project JARs intentionally have the same distribution filename.
    eachFile { details ->
        if (details.relativePath.pathString.startsWith('lib/')) {
            def standalone = standaloneRuntimeJar.get().asFile.canonicalFile
            if (details.file.canonicalFile != standalone) {
                details.exclude()
            }
        }
    }
}

tasks.register('verifyJoniDistribution', Exec) {
    description = 'Verifies the installed distribution uses only relocated Joni classes'
    group = 'verification'
    dependsOn installDist, copyWrapperScripts, copyPerlBinScripts
    inputs.file('dev/regex/tools/verify-joni-distribution.pl')
    inputs.file('third_party/joni/LICENSE')
    inputs.file('third_party/joni/PERLONJAVA-NOTICE.md')
    inputs.file('third_party/licenses/jcodings-LICENSE.txt')
    inputs.dir("${buildDir}/install/perlonjava")
    commandLine 'perl', 'dev/regex/tools/verify-joni-distribution.pl',
        "${buildDir}/install/perlonjava"
}

// A direct installDist invocation is fail-closed, and Debian staging cannot
// start until the same installed tree has passed verification.  The verifier
// depends only on the completed install tree, so this adds no producer cycle.
tasks.named('installDist') {
    finalizedBy verifyJoniDistribution
}
tasks.named('buildDeb') {
    dependsOn verifyJoniDistribution
}

tasks.register('verifyJoniPackaging', Exec) {
    description = 'Verifies Joni namespace isolation, notices, and SBOM metadata'
    group = 'verification'
    dependsOn shadowJar
    inputs.file("dev/regex/tools/verify-joni-packaging.pl")
    inputs.file("target/perlonjava-${project.version}.jar")
    inputs.file("build/reports/sbom.json")
    commandLine 'perl', 'dev/regex/tools/verify-joni-packaging.pl',
        '--strict', "target/perlonjava-${project.version}.jar", 'build/reports/sbom.json'
}

// Some Perl unit tests spawn a child interpreter via $^X. Under Gradle those
// children go through the repository launcher, so the target jar must be built
// before tests run; otherwise a stale target/perlonjava-*.jar can be executed.
tasks.withType(Test).configureEach { t ->
    t.dependsOn shadowJar

    def jperlLauncher = org.gradle.internal.os.OperatingSystem.current().isWindows()
            ? "jperl.bat" : "jperl"
    t.environment 'PERLONJAVA_EXECUTABLE', file(jperlLauncher).absolutePath
}

// Task to generate Perl SBOM
tasks.register('generatePerlSbom', Exec) {
    description = 'Generate SBOM for bundled Perl modules'
    group = 'sbom'
    def outputFile = layout.buildDirectory.file("reports/perl-bom.json")
    
    workingDir = projectDir
    commandLine 'perl', 'dev/tools/generate-perl-sbom.pl'
    doFirst {
        def file = outputFile.get().asFile
        file.parentFile.mkdirs()
        standardOutput = new FileOutputStream(file)
    }
    doLast {
        standardOutput.close()
    }
    
    // Declare output so Gradle waits for completion
    outputs.file(outputFile)
}

// Task to merge Java and Perl SBOMs
tasks.register('mergeSbom', Exec) {
    description = 'Merge Java and Perl SBOMs into combined SBOM'
    group = 'sbom'
    dependsOn cyclonedxBom, generatePerlSbom
    def outputFile = layout.buildDirectory.file("reports/sbom.json")
    
    // Declare inputs so Gradle knows dependencies
    inputs.file("build/reports/bom.json")
    inputs.file("build/reports/perl-bom.json")
    inputs.file("dev/tools/merge-sbom.pl")
    
    workingDir = projectDir
    commandLine 'perl', 'dev/tools/merge-sbom.pl',
        'build/reports/bom.json', 'build/reports/perl-bom.json'
    doFirst {
        def file = outputFile.get().asFile
        file.parentFile.mkdirs()
        standardOutput = new FileOutputStream(file)
    }
    doLast {
        standardOutput.close()
    }
    
    // Declare output
    outputs.file(outputFile)
}

// Ensure combined SBOM is generated before shadowJar
shadowJar.dependsOn mergeSbom

// Make shadowJar part of the build process
tasks.named('build') {
    dependsOn shadowJar
}

// Source sets configuration for including Perl resources
sourceSets {
    main {
        java {
            // Start below Joni's optional Java 9 module descriptor so the
            // otherwise classpath-based PerlOnJava build remains unnamed.
            srcDir 'third_party/joni/src/org'
        }
        resources {
            srcDir 'src/main/perl'
            srcDir 'src/main/resources'
            include '**/*.pm'
            include '**/*.pl'
            include '**/*.ph'
            include '**/*.pod'
            include '**/*.dd'
            include '**/*.yml'
            include '**/*.json'
            include '**/*.patch'
            include 'lib/Unicode/Collate/*.txt'
            include '**/media.types'
            // AutoLoader-generated Perl method bodies and their indexes.
            include 'lib/auto/**'
            include 'lib/ExtUtils/xsubpp'
            include 'bin/**'
            include 'META-INF/services/**'
        }
    }
    joniTest {
        java.srcDir 'third_party/joni/test'
        compileClasspath += sourceSets.main.output + configurations.testRuntimeClasspath
        runtimeClasspath += output + compileClasspath
    }
    test {
        resources {
            srcDir 'src/test/resources'
        }
    }
}

configurations {
    joniTestImplementation.extendsFrom testImplementation
    joniTestRuntimeOnly.extendsFrom testRuntimeOnly
}

dependencies {
    joniTestImplementation 'junit:junit:4.13.2'
}

tasks.register('testJoni', Test) {
    description = 'Runs the imported upstream Joni test suite'
    group = 'verification'
    testClassesDirs = sourceSets.joniTest.output.classesDirs
    classpath = sourceSets.joniTest.runtimeClasspath
    useJUnit()
}

// Resource processing configuration
tasks.named('processResources', Copy) {
    from(sourceSets.main.resources.srcDirs) {
        include '**/*.pm'
        include '**/*.ph'
        include '**/*.pod'
        include '**/*.dd'
        include '**/*.yml'
        include '**/*.json'
        include 'lib/Unicode/Collate/*.txt'
        include '**/media.types'
        // AutoLoader-generated Perl method bodies and their indexes.
        include 'lib/auto/**'
        include 'bin/**'
        include 'META-INF/services/**'
    }
    into("$buildDir/resources/main")
    duplicatesStrategy = DuplicatesStrategy.EXCLUDE
}

// Test resource processing configuration
tasks.named('processTestResources', Copy) {
    duplicatesStrategy = DuplicatesStrategy.EXCLUDE
    // This fixture asserts command-line -W semantics and is executed from the
    // dedicated JVM/interpreter CLI gate with that flag. Keeping it out of the
    // ordinary resource corpus prevents a default invocation from pretending
    // to exercise a command-line contract it does not supply.
    exclude 'unit/custom_warning_command_line_W.t'
}

// Parallel test execution tasks
// Run with: ./gradlew testUnitParallel --parallel
//
// Shard layout: the LAST shard is dedicated to a small set of known-heavy
// tests (see HEAVY_TESTS in PerlScriptExecutionTest.java). The other shards
// round-robin the remaining tests. This keeps wall-time roughly balanced
// even when one test dominates (e.g. unit/code_too_large.t).
def parallelShards = 5

(0..<parallelShards).each { index ->
    tasks.register("testUnitShard${index}", Test) {
        group = 'verification'
        description = "Runs shard ${index} of ${parallelShards} of unit tests"
        
        useJUnitPlatform {
            includeTags 'unit'
            excludeTags 'full'
        }
        
        systemProperty 'test.shard.index', index
        systemProperty 'test.shard.total', parallelShards
        
        testClassesDirs = sourceSets.test.output.classesDirs
        classpath = sourceSets.test.runtimeClasspath
    }
}

tasks.register('testUnitParallel') {
    group = 'verification'
    description = 'Runs unit tests in parallel across multiple JVMs. Usage: gradle testUnitParallel --parallel'
    def shardTasks = (0..<parallelShards).collect { "testUnitShard${it}" }
    dependsOn shardTasks
    dependsOn testJoni
    dependsOn verifyJoniPackaging
}

// Version catalog update configuration
// The nl.littlerobots.version-catalog-update plugin is configuration cache compatible!
// Use: ./gradlew versionCatalogUpdate to check and update dependencies
// Use: ./gradlew versionCatalogUpdate --interactive to review changes interactively
versionCatalogUpdate {
    // Sort the catalog keys
    sortByKey = true
    // Keep versions not used in the project
    keep {
        keepUnusedVersions = true
    }
    // Pin cyclonedx plugin to current 2.x version.
    //
    // cyclonedx 3.x is NOT compatible with this build for four reasons:
    //   1. schemaVersion changed from string "1.5" to enum "VERSION_15"
    //   2. outputName/outputFormat properties were removed; output is now
    //      configured via jsonOutput/xmlOutput file properties, and the
    //      default path moved from build/reports/bom.json to
    //      build/reports/cyclonedx/bom.json (breaks the mergeSbom task)
    //   3. organizationalEntity closure API was removed from the aggregate
    //      task (CyclonedxAggregateTask)
    //   4. Gradle 9.x triggers "No XmlService implementation found" at
    //      runtime due to a missing Maven API dependency in the plugin
    //
    // To unpin: upgrade Gradle first, then adapt the cyclonedxBom block
    // and mergeSbom input path above to the 3.x API. See:
    //   https://github.com/CycloneDX/cyclonedx-gradle-plugin (v3 README)
    //
    // Pin shadow to 9.3.x - shadow 9.4.x introduces a classpath conflict
    // that triggers "No XmlService implementation found" from the cyclonedx
    // plugin. Unpin after cyclonedx is upgraded to 3.x.
    pin {
        plugins = [libs.plugins.cyclonedx, libs.plugins.shadow]
    }
}