feat: migrate from GraalVM Native Image to JAR distribution (#309)

* docs: migrate from GraalVM Native Image to JAR distribution

Complete migration from platform-specific native binaries to universal JAR bundle distribution.

Major Changes:
- Distribution: Single JAR bundle (~20MB) replacing 6 platform binaries (~260MB)
- Runtime: Now requires Java 21+ instead of platform-specific native executables
- Build: Shadow JAR plugin replaces GraalVM Native Image compilation
- CI/CD: Simplified workflow building universal JAR instead of multi-platform binaries
- SBOM: Dual-level approach (source + binary SBOMs)

Documentation Updates:
- Renamed install-jar.ps1 → install.ps1 for consistency
- Removed obsolete native binary docs (install/README.md, install/verify-README.md)
- Updated SBOM verification guide for JAR bundle structure
- Updated security verification guides with JAR-specific instructions
- Created ADR-0017 documenting migration rationale

Technical Cleanup:
- Removed GraalVM Native Image configuration files
- Removed platform-specific build workflows
- Cleaned up obsolete environment variables
- Updated all documentation references

🤖 Generated with [Claude Code](https://claude.ai/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>

* chore: prevent Gradle cache files from causing spotless lint errors

Add comprehensive protections against Gradle cache lint errors:
- Add .gradle-local/ to .gitignore
- Create scripts/clean-gradle-cache.sh for cleaning all Gradle caches
- Update spotless configuration to exclude .gradle-local/** from all targets
- Exclude package.json from spotless JSON formatting

This prevents the 1079 lint errors that occurred in the previous commit
when pre-commit hooks ran spotless checks on auto-generated Gradle cache
files in .gradle-local/ directory.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>

* fix: address AI review feedback for JAR distribution

Critical installer fixes:
- Fix bash installer hash verification (extract checksum token properly)
- Fix PowerShell installer hash verification (parse digest from hash file)
- Update script name references in install.ps1 (install-jar.ps1 → install.ps1)

Wrapper script improvements:
- Improve Java version parsing in bash wrapper (support Java 8 format: 1.8.0_xxx)
- Add config file support to batch wrapper (scopes.bat)
- Guard Java version parsing in batch wrapper (handle parse failures gracefully)
- Improve config parsing in bash wrapper (trim whitespace from key=value)
- Enhance PowerShell wrapper error messages (add installation instructions)

Documentation fixes:
- Fix SLSA verification path (add missing verification/ prefix)
- Standardize version placeholders (use vX.X.X consistently)
- Update getting-started.md with correct install instructions
- Add language identifiers to code blocks in ADR-0017
- Fix absolute path in jni-config.md (remove leading slash)

All fixes address specific issues identified in AI code review:
- Hash verification now works correctly on Linux/macOS/Windows
- Java version detection handles both old (1.x) and new (21+) formats
- Config file parsing is robust to whitespace and quotes
- Documentation references are accurate and consistent

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>

* docs: remove obsolete jni-config.md

The jni-config.md document is no longer applicable after migration
from GraalVM Native Image to JAR distribution. JNI configuration is
not required for standard JVM execution with SQLite JDBC driver.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>

* fix: remove obsolete GraalVM Native Image feature file

This file was only needed for GraalVM Native Image compilation and is no longer relevant after migrating to JAR distribution. Its presence was causing CodeQL Autobuild to fail with:
- error: package org.graalvm.nativeimage.hosted does not exist

Fixes CodeQL workflow failure on this branch.

---------

Co-authored-by: Claude <noreply@anthropic.com>

Author: kamiazya

.changeset/jar-distribution-docs-update.md

@@ -0,0 +1,43 @@
+---
+"scopes": patch
+---
+
+Migrate from GraalVM Native Image to JAR distribution
+
+**Breaking Change**: Distribution format changed from platform-specific native binaries to universal JAR bundle.
+
+### Migration Details
+
+- **Distribution Format**: Changed from 6 platform-specific native binaries (~260MB total) to single universal JAR bundle (~20MB)
+- **Runtime Requirement**: Now requires Java 21+ to be installed on the target system
+- **Installation Method**: JAR bundle includes wrapper scripts (bash, batch, PowerShell) for platform-agnostic execution
+- **SBOM Structure**: Dual SBOM approach - source-level (`sbom/scopes-sbom.json`) and binary-level (`sbom/scopes-binary-sbom.json`)
+
+### Technical Changes
+
+- Removed GraalVM Native Image build configuration and related plugins
+- Implemented Shadow JAR plugin for creating fat JARs with all dependencies
+- Updated CI/CD workflows to build universal JAR instead of platform-specific binaries
+- Removed platform-specific build jobs (linux-x64, darwin-x64, darwin-arm64, win32-x64, etc.)
+- Cleaned up GraalVM-specific configuration files (`native-image.properties`, `reflect-config.json`, etc.)
+
+### Documentation Updates
+
+- Renamed `install-jar.ps1` to `install.ps1` for consistency with `install.sh`
+- Removed obsolete native binary documentation (`install/README.md`, `install/verify-README.md`, `install/offline/`)
+- Updated all security verification guides to reflect JAR bundle structure
+- Updated getting started guide with Java 21 requirement
+- Created ADR-0017 documenting the migration decision and rationale
+
+### User Impact
+
+**Benefits**:
+- Smaller download size (~20MB vs ~260MB for all platforms)
+- Faster startup time and lower memory footprint
+- No platform-specific build issues
+- Easier to debug and profile with standard JVM tools
+
+**Migration Required**:
+- Users must have Java 21+ installed (see docs/explanation/setup/java-setup.md)
+- Update installation scripts to use new JAR bundle format
+- Replace platform-specific binaries with universal JAR + wrapper scripts

.github/ISSUE_TEMPLATE/graalvm-config-cache-issue.md

@@ -1,11 +1,15 @@
 ---
-name: GraalVM Native Build Configuration Cache Incompatibility
-about: Track the GraalVM plugin configuration cache compatibility issue
-title: "GraalVM native build fails with configuration cache enabled"
-labels: bug, build, blocked, upstream
+name: "[DEPRECATED] GraalVM Native Build Configuration Cache Incompatibility"
+about: "[DEPRECATED - No longer applicable] This issue template was for GraalVM Native Image builds, which have been replaced by JAR distribution"
+title: "[DEPRECATED] GraalVM native build fails with configuration cache enabled"
+labels: deprecated, wontfix
 assignees: ''
 ---
 
+> **⚠️ DEPRECATED**: This issue template is no longer applicable. Scopes has migrated from GraalVM Native Image compilation to JAR distribution. Native Image builds are no longer part of the release process.
+>
+> For current build issues, please use the standard bug report template.
+
 ## Problem Description
 
 The GraalVM native build plugin (v0.11.0) is incompatible with Gradle's configuration cache feature, causing build failures in CI environments.