Make WrapperDownloader work for java >= 11 (#15400)

* Try to check the bootstrap script with the lowest supported jdk (11).

* Add repo clone on gradleScriptBootstrapCheck. Run remaining jobs only if the boostrap passes.

* Don't fail on ./gradlew, capture stderr too.

* One more try.

* Add the check and inline suppress forbidden apis.

* Remove status code check as we can't rely on jdk returning a constant value.

* Remove unused status variable. Add timeout.

* Tidy.

* Allow inner classes to serve as forbidden api suppressors.

Author: dweiss

.github/workflows/run-checks-gradle-upgrade.yml

@@ -25,9 +25,38 @@ env:
   DEVELOCITY_ACCESS_KEY: ${{ secrets.DEVELOCITY_ACCESS_KEY }}
 
 jobs:
+  gradleScriptBootstrapCheck:
+    name: "Check gradle boostrap script sanity on old JVMs."
+    timeout-minutes: 30
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/setup-java@c5195efecf7bdfc987ee8bae7a71cb8b11521c00 # v4.7.1
+        with:
+          distribution: 'temurin'
+          java-version: 11
+          java-package: jdk
+
+      - name: Checkout repository
+        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+        with:
+          persist-credentials: false
+
+      - shell: bash
+        run: |
+          set +e
+          output=$(./gradlew 2>&1)
+          if [[ "$output" == *"ERROR: java version must be"* ]]; then
+            echo "Passed."
+          else
+            echo "Something is not right: gradlew command returned suspicious output or status code on JDK 11"
+            echo -e "gradlew output echoed below:\n\n$output\n\n---(end of output)"
+            exit 1
+          fi
+
   gradleSanityCheck:
     name: "Run tasks (java: ${{ matrix.java-version }}, alt-java: ${{ matrix.uses-alt-java }})"
     timeout-minutes: 30
+    needs: gradleScriptBootstrapCheck
 
     strategy:
       matrix:

build-tools/build-infra/src/main/java/org/apache/lucene/gradle/WrapperDownloader.java

@@ -21,6 +21,10 @@
 import java.io.IOException;
 import java.io.InputStream;
 import java.io.OutputStream;
+import java.lang.annotation.ElementType;
+import java.lang.annotation.Retention;
+import java.lang.annotation.RetentionPolicy;
+import java.lang.annotation.Target;
 import java.net.HttpURLConnection;
 import java.net.URI;
 import java.net.URL;
@@ -41,6 +45,18 @@
  * <p>Ensure this class has no dependencies outside of standard java libraries as it's used direct
  */
 public class WrapperDownloader {
+  /**
+   * Copied to keep the class isolated from any other classes.
+   *
+   * @see "https://github.com/apache/lucene/issues/15399"
+   */
+  @Retention(RetentionPolicy.CLASS)
+  @Target({ElementType.CONSTRUCTOR, ElementType.FIELD, ElementType.METHOD, ElementType.TYPE})
+  private @interface SuppressForbidden {
+    /** A reason for suppressing should always be given. */
+    String reason();
+  }
+
   public static void main(String[] args) {
     if (args.length != 1) {
       System.err.println("Usage: java WrapperDownloader.java <destination>");

build-tools/build-infra/src/main/java/org/apache/lucene/gradle/plugins/java/ApplyForbiddenApisPlugin.java

@@ -69,7 +69,8 @@ public void apply(Project project) {
               .addAll(
                   List.of("jdk-unsafe", "jdk-deprecated", "jdk-non-portable", "jdk-reflection"));
 
-          task.getSuppressAnnotations().add("**.SuppressForbidden");
+          task.getSuppressAnnotations()
+              .addAll(List.of("**.SuppressForbidden", "**.*$SuppressForbidden"));
 
           // apply logger restrictions to all modules except Luke.
           if (!project.getPath().equals(":lucene:luke")) {