Skip to content

Conversation

@koppor
Copy link
Member

@koppor koppor commented Dec 26, 2025

User description

Now that jbangdev/jbang-gradle-plugin#7 is fixed in the respective main we can use configuration caching 🎉

Ports jbangdev/jbang-gradle-plugin#21 to here.

Steps to test

  • Execute ./gradlew --rerun-tasks :jablib:generateJournalListMV
  • Execute ./gradlew :jabgui:run.

Mandatory checks

  • I own the copyright of the code submitted and I license it under the MIT license
  • I manually tested my changes in running JabRef (always required)
  • [/] I added JUnit tests for changes (if applicable)
  • [/] I added screenshots in the PR description (if change is visible to the user)
  • [/] I described the change in CHANGELOG.md in a way that is understandable for the average user (if change is visible to the user)
  • [/] I checked the user documentation: Is the information available and up to date? If not, I created an issue at https://github.com/JabRef/user-documentation/issues or, even better, I submitted a pull request updating file(s) in https://github.com/JabRef/user-documentation/tree/main/en.

PR Type

Enhancement


Description

  • Enable Gradle configuration caching for improved build performance

  • Replace custom download task with gradle-download-plugin

  • Update jbang-gradle-plugin to latest version

  • Reorder plugin application in module configuration


Diagram Walkthrough

flowchart LR
  A["Configuration Caching Disabled"] -->|Enable caching| B["Configuration Caching Enabled"]
  C["Custom Download Task"] -->|Use gradle-download-plugin| D["Gradle Download Plugin"]
  E["Old jbang Plugin"] -->|Update to latest| F["Latest jbang Plugin"]
  B --> G["Improved Build Performance"]
  D --> G
Loading

File Walkthrough

Relevant files
Dependencies
build.gradle.kts
Add gradle-download-plugin dependency                                       

build-logic/build.gradle.kts

  • Added gradle-download-plugin dependency version 5.6.0
+1/-0     
build.gradle.kts
Add download plugin and update jbang plugin                           

jablib/build.gradle.kts

  • Added org.jabref.gradle.feature.download plugin
  • Updated jbang-gradle-plugin version to jitpack-SNAPSHOT
  • Updated jbang plugin version comment from 0.2.0 to 0.3.0
  • Updated jitpack build reference URL
+9/-31   
Configuration changes
org.jabref.gradle.feature.download.gradle.kts
Create download feature plugin configuration                         

build-logic/src/main/kotlin/org.jabref.gradle.feature.download.gradle.kts

  • New plugin configuration file for download feature
  • Applies de.undercouch.download plugin
+3/-0     
org.jabref.gradle.module.gradle.kts
Reorder plugin application sequence                                           

build-logic/src/main/kotlin/org.jabref.gradle.module.gradle.kts

  • Reordered plugin application order
  • Moved checkstyle and modernizer plugins before feature plugins
+2/-2     
Enhancement
gradle.properties
Enable Gradle configuration caching                                           

gradle.properties

  • Enabled org.gradle.configuration-cache from false to true
  • Enabled org.gradle.configuration-cache.parallel
  • Removed blocking issue comment reference
+2/-3     
build.gradle.kts
Replace custom download with gradle-download-plugin           

jablib/build.gradle.kts

  • Replaced custom downloadLtwaFile task with gradle-download-plugin
    implementation
  • Changed from manual URI download to Download task type
  • Added onlyIfModified flag for efficient caching
  • Simplified task implementation from 30+ lines to 4 lines
  • Changed ltwaCsvFile from var to val
+9/-31   

@qodo-free-for-open-source-projects
Copy link
Contributor

qodo-free-for-open-source-projects bot commented Dec 26, 2025

PR Compliance Guide 🔍

Below is a summary of compliance checks for this PR:

Security Compliance
Unstable dependency version

Description: Using a snapshot version from JitPack ('jitpack-SNAPSHOT') introduces supply chain risk as
the dependency content can change without notice, potentially introducing malicious code
or vulnerabilities.
build.gradle.kts [24-24]

Referred Code
id("com.github.koppor.jbang-gradle-plugin") version "jitpack-SNAPSHOT"
Unverified external download

Description: Downloading files from external URLs without integrity verification (checksum/hash
validation) allows potential man-in-the-middle attacks or compromised source servers to
inject malicious content.
build.gradle.kts [282-282]

Referred Code
src("https://www.issn.org/wp-content/uploads/2021/07/ltwa_20210702.csv")
dest(ltwaCsvFile)
Ticket Compliance
🎫 No ticket provided
  • Create ticket/issue
Codebase Duplication Compliance
Codebase context is not defined

Follow the guide to enable codebase context checks.

Custom Compliance
🟢
Generic: Comprehensive Audit Trails

Objective: To create a detailed and reliable record of critical system actions for security analysis
and compliance.

Status: Passed

Learn more about managing compliance generic rules or creating your own custom rules

Generic: Meaningful Naming and Self-Documenting Code

Objective: Ensure all identifiers clearly express their purpose and intent, making code
self-documenting

Status: Passed

Learn more about managing compliance generic rules or creating your own custom rules

Generic: Robust Error Handling and Edge Case Management

Objective: Ensure comprehensive error handling that provides meaningful context and graceful
degradation

Status: Passed

Learn more about managing compliance generic rules or creating your own custom rules

Generic: Secure Error Handling

Objective: To prevent the leakage of sensitive system information through error messages while
providing sufficient detail for internal debugging.

Status: Passed

Learn more about managing compliance generic rules or creating your own custom rules

Generic: Secure Logging Practices

Objective: To ensure logs are useful for debugging and auditing without exposing sensitive
information like PII, PHI, or cardholder data.

Status: Passed

Learn more about managing compliance generic rules or creating your own custom rules

Generic: Security-First Input Validation and Data Handling

Objective: Ensure all data inputs are validated, sanitized, and handled securely to prevent
vulnerabilities

Status: Passed

Learn more about managing compliance generic rules or creating your own custom rules

  • Update
Compliance status legend 🟢 - Fully Compliant
🟡 - Partial Compliant
🔴 - Not Compliant
⚪ - Requires Further Human Verification
🏷️ - Compliance label

@qodo-free-for-open-source-projects
Copy link
Contributor

qodo-free-for-open-source-projects bot commented Dec 26, 2025

PR Code Suggestions ✨

Explore these optional code suggestions:

CategorySuggestion                                                                                                                                    Impact
High-level
Avoid SNAPSHOT dependency for build stability
Suggestion Impact:The commit removed the jitpack-SNAPSHOT version specification from the jbang-gradle-plugin dependency. However, instead of replacing it with a stable version or commit hash as suggested, the version was removed entirely, leaving the plugin declaration without a version. This partially addresses the concern by removing the unstable SNAPSHOT dependency, though it doesn't follow the exact recommendation of specifying a stable version.

code diff:

-    // Build state at https://jitpack.io/#koppor/jbang-gradle-plugin/jitpack-SNAPSHOT
-    id("com.github.koppor.jbang-gradle-plugin") version "jitpack-SNAPSHOT"
+    id("com.github.koppor.jbang-gradle-plugin")

The PR introduces a jitpack-SNAPSHOT dependency for the jbang-gradle-plugin. To
ensure build stability and reproducibility, this should be replaced with a
stable, released version or pinned to a specific commit hash.

Examples:

jablib/build.gradle.kts [24]
    id("com.github.koppor.jbang-gradle-plugin") version "jitpack-SNAPSHOT"

Solution Walkthrough:

Before:

// jablib/build.gradle.kts
plugins {
    // ...
    // Build state at https://jitpack.io/#koppor/jbang-gradle-plugin/jitpack-SNAPSHOT
    id("com.github.koppor.jbang-gradle-plugin") version "jitpack-SNAPSHOT"
    // ...
}

After:

// jablib/build.gradle.kts
plugins {
    // ...
    // Use a stable release or a specific commit hash
    id("com.github.koppor.jbang-gradle-plugin") version "<stable-version-or-commit-hash>"
    // ...
}
Suggestion importance[1-10]: 9

__

Why: The suggestion correctly identifies a critical issue with using a jitpack-SNAPSHOT dependency, which makes the build non-reproducible and prone to breaking, and this change is a core part of the PR.

High
Learned
best practice
Use val for immutable variables

Change task variable declarations from 'var' to 'val' for consistency with the
newly changed ltwaCsvFile variable. These task references are never reassigned
and should be immutable.

jablib/build.gradle.kts [255-287]

-var taskGenerateJournalListMV = tasks.register<JBangTask>("generateJournalListMV") {
+val taskGenerateJournalListMV = tasks.register<JBangTask>("generateJournalListMV") {
 ...
-var taskGenerateCitationStyleCatalog = tasks.register<JBangTask>("generateCitationStyleCatalog") {
+val taskGenerateCitationStyleCatalog = tasks.register<JBangTask>("generateCitationStyleCatalog") {
 ...
-var taskGenerateLtwaListMV = tasks.register<JBangTask>("generateLtwaListMV") {
+val taskGenerateLtwaListMV = tasks.register<JBangTask>("generateLtwaListMV") {

[To ensure code accuracy, apply this suggestion manually]

Suggestion importance[1-10]: 6

__

Why:
Relevant best practice - Use consistent variable declaration patterns. Prefer 'val' for immutable variables to improve code safety and clarity.

Low
General
Extract hardcoded version to constant

Extract the hardcoded date 20210702 from the URL and filename into a constant to
improve maintainability.

jablib/build.gradle.kts [279-285]

-val ltwaCsvFile = layout.buildDirectory.file("tmp/ltwa_20210702.csv")
+val ltwaVersion = "20210702"
+val ltwaCsvFile = layout.buildDirectory.file("tmp/ltwa_$ltwaVersion.csv")
 
 tasks.register<de.undercouch.gradle.tasks.download.Download>("downloadLtwaFile") {
-    src("https://www.issn.org/wp-content/uploads/2021/07/ltwa_20210702.csv")
+    src("https://www.issn.org/wp-content/uploads/2021/07/ltwa_$ltwaVersion.csv")
     dest(ltwaCsvFile)
     onlyIfModified(true)
 }
  • Apply / Chat
Suggestion importance[1-10]: 5

__

Why: The suggestion correctly identifies a repeated hardcoded value and proposes extracting it into a constant, which improves code maintainability by following the DRY principle.

Low
  • Update

@Siedlerchr
Copy link
Member

  • Task :jablib:generateJournalListMV of type dev.jbang.gradle.tasks.JBangTask: cannot serialize Gradle script object references as these are not supported with the configuration cache.

@Siedlerchr
Copy link
Member

  • In plugin 'com.github.koppor.jbang-gradle-plugin' type 'dev.jbang.gradle.tasks.JBangTask' property 'installDir' specifies directory '/home/runner/.gradle/caches/jbang' which doesn't exist.

@Siedlerchr
Copy link
Member

Siedlerchr commented Dec 26, 2025 via email

@koppor
Copy link
Member Author

koppor commented Dec 26, 2025

You have overwritten my changes for creating the directory

Because I included it in the plugin itself.

@koppor
Copy link
Member Author

koppor commented Dec 26, 2025

You have overwritten my changes for creating the directory

Because I included it in the plugin itself.

Commit removing here: f8c952a

Commit adding to plugin: koppor/jbang-gradle-plugin@660863b

@Siedlerchr
Copy link
Member

Siedlerchr commented Dec 26, 2025 via email

@koppor
Copy link
Member Author

koppor commented Dec 27, 2025

Current state:


1 problem was found storing the configuration cache.
- Task `:jablib:generateJournalListMV` of type `dev.jbang.gradle.tasks.JBangTask`: cannot serialize Gradle script object references as these are not supported with the configuration cache.
  See https://docs.gradle.org/9.3.0-20251116230000+0000/userguide/configuration_cache_requirements.html#config_cache:requirements:disallowed_types

Refs gradle/gradle#20930

Siedlerchr and others added 4 commits December 27, 2025 12:41
* upstream/fix-caching:
  Fix cache update for JBang (#14727)
  update citeproc (#14724)
  Throttle calls for workflow triggering
@Siedlerchr
Copy link
Member

So with the latest changes this worked

@koppor koppor enabled auto-merge December 27, 2025 20:41
@koppor koppor added this pull request to the merge queue Dec 27, 2025
implementation("com.adarshr:gradle-test-logger-plugin:4.0.0")
implementation("com.autonomousapps:dependency-analysis-gradle-plugin:3.5.1")
implementation("com.github.andygoossens:gradle-modernizer-plugin:1.12.0")
implementation("com.github.koppor:jbang-gradle-plugin:jitpack-SNAPSHOT")
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pinned commit?

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Raises error when gradlew runs - plugin says jitpack-SNAPSHOT, but outputs commit id.

@github-merge-queue github-merge-queue bot removed this pull request from the merge queue due to failed status checks Dec 27, 2025
@Siedlerchr Siedlerchr added this pull request to the merge queue Dec 27, 2025
@github-merge-queue github-merge-queue bot removed this pull request from the merge queue due to failed status checks Dec 27, 2025
@Siedlerchr Siedlerchr added this pull request to the merge queue Dec 27, 2025
Merged via the queue into main with commit c093a77 Dec 27, 2025
54 checks passed
@Siedlerchr Siedlerchr deleted the fix-caching branch December 27, 2025 21:51
@koppor koppor mentioned this pull request Jan 12, 2026
2 tasks
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants