Move legacy command compatibility tests into an end-to-end build

Addresses the outstanding review feedback on the Grails 7 command
compatibility layer.

Build placement. The Grails 7 fixture needs Java 17 - the minimum for a
Grails 7 app, so the binary matches what a real Grails 7 plugin is built
with - but expressing that as a Gradle toolchain put an unprovisionable
JDK requirement into the core build's task graph. Nothing in the repo
provisions a 17 (no foojay resolver, no toolchainManagement, no
org.gradle.java.installations.*), and because the fixture jar was an
implementation dependency, `./gradlew build -PskipTests` reached it - so
the build failed on the JDK the project documents in .sdkmanrc and in the
reproducible-build container. CI only passed because the runner images
happen to ship a 17 that Gradle auto-detects.

The three projects now live in a new top-level end-to-end build, so the
root build no longer reaches them. The fixture declares its JDK and
Gradle version in its own .sdkmanrc, matching what Grails 7 pins (17 and
8.14.5) rather than what this repository builds with, and is excluded
from the gradle-bootstrap wrapper propagation for that reason; the
end-to-end build itself is added to that propagation and tracks the root.
A dedicated workflow provisions both JDKs, reading the versions out of
those files.

Resolution goes through published artifacts rather than project
substitution, which is what makes these tests end-to-end: they consume
grails-core the way an application does, through real poms and module
metadata. The repository is the same build/local-maven that grails-forge
points its generated applications at, populated by
publishAllPublicationsToTestCaseMavenRepoRepository in both the root and
grails-gradle builds. settings.gradle scopes it with exclusiveContent so
a remote snapshot cannot quietly satisfy an org.apache.grails request and
leave the suite testing something other than the working tree.

That also disposes of the CLI companion problem rather than working
around it. grails-core-cli is a secondary capability of :grails-core, not
a project, so composite substitution cannot express it and hits a
capability self-conflict - but it is a first-class published module whose
metadata CliPublishingSupport already rewrites for external consumers, so
resolving from the repository gets it for free.

Trait-derived command names. Every legacy command in the tree overrode
getName()/getDescription(), so the trait's default derivation - what
create-command generated on Grails 7, and therefore what most published
Grails 7 commands rely on for their registration key - had no coverage.
Adds a third precompiled command declaring neither getter.

Factory resource failures are no longer silent. loadFactoryDeclarations
dropped a malformed resource with no log line at any level, and it backs
modern grails-cli.factories discovery, so one bad file lost every one of
a plugin's Grails 8 commands and providers. It now warns with the
resource URL and cause, keeping the per-resource isolation.

skipBootstrap resolution is covered. The lookup moves into a static
helper so the adapter-target case - where reading the flag off the
adapter instead of its target would let BootStrap run during dbm-update -
is guarded by a test.

Commands are now deduplicated across the registry and context
classloaders the way providers already were. A command declared in a
resource visible through both was constructed twice and the second
instance discarded, which the surrounding comment says the code exists to
avoid; an existing assertion encoded that double construction and now
asserts a single one.

Legacy commands take part in ordering. Modern commands are sorted before
first-wins registration, but legacy ones were registered in factory scan
order and the adapter carried none of the target's ordering, so two
Grails 7 plugins declaring the same command name resolved by jar order.
The adapter now projects the target's Ordered/@order onto itself and the
provider sorts before registering, restoring Grails 7 semantics.

ThreadDeath handling is removed from the four fatal-error guards.
Thread.stop() was removed in JDK 20, so on the 21 baseline the only
instances that branch ever saw were the ones the tests constructed, and
the type is deprecated for removal. VirtualMachineError handling and the
wrapped-cause walk are unchanged, and the specs now prove rethrow across
two VirtualMachineError subtypes instead. The duplicated rethrowIfFatal
is deliberately left in place: grails-shell-cli cannot see grails-core at
compile time, so consolidating would mean new public API on a
general-purpose utility for a CLI-internal concern.

Test quality. A spec named for a plugin-origin resolution failure
described a code path that does not exist and whose failure branch was
unreachable; it is renamed to what it verifies, with the dead branch
removed. AbstractProfile's unknown-command path, changed by this work but
uncovered, gets a spec driving the public Profile.handleCommand.

Also collapses two byte-identical instantiate helpers, drops a duplicated
fixture version pin in the integration spec, and corrects comments
describing the fixture as an included composite build.

Author: jdaugherty

.github/workflows/end-to-end.yml

@@ -0,0 +1,140 @@
+# Licensed to the Apache Software Foundation (ASF) under one or more
+# contributor license agreements.  See the NOTICE file distributed with
+# this work for additional information regarding copyright ownership.
+# The ASF licenses this file to You under the Apache License, Version 2.0
+# (the "License"); you may not use this file except in compliance with
+# the License.  You may obtain a copy of the License at
+#
+#     https://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+# The end-to-end suite is its own Gradle build, so the core build never reaches it and
+# `./gradlew build` at the root is unaffected.
+#
+# It resolves Grails from the artifacts the core build publishes rather than by project
+# substitution - that is what makes the tests end-to-end. The repository is the same
+# build/local-maven that grails-forge points its generated applications at, populated by
+# publishAllPublicationsToTestCaseMavenRepoRepository, so the suite exercises real poms and
+# module metadata including the CLI companion artifacts.
+#
+# It also needs two JDKs, which is the other reason it gets its own workflow: the Grails 7
+# fixture must be compiled on Java 17 (the minimum for a Grails 7 app, so the binary matches
+# what a real Grails 7 plugin is built with), while the core build and the Grails 8
+# application consuming the fixture need 21. The Grails 8 side simply tracks the repository's
+# root .sdkmanrc - it has to run on whatever the core build it consumes runs on - and only the
+# fixture carries its own pin. The steps below read both out of those files rather than relying
+# on Gradle toolchain auto-detection.
+name: "End to End"
+on:
+  workflow_dispatch:
+  push:
+    branches:
+      - '[0-9]+.[0-9]+.x'
+      # The legacy command compatibility work these tests cover is still in review. Run the suite
+      # on its branch so the result is visible on the pull request; drop this entry once it merges.
+      - 'feat/8.0.x-legacy-command-compat'
+    paths:
+      - 'end-to-end/**'
+      - 'grails-core/**'
+      - 'grails-core-cli-legacy/**'
+      - 'grails-console/**'
+      - 'grails-gradle/**'
+      - '.github/workflows/end-to-end.yml'
+  pull_request:
+    paths:
+      - 'end-to-end/**'
+      - 'grails-core/**'
+      - 'grails-core-cli-legacy/**'
+      - 'grails-console/**'
+      - 'grails-gradle/**'
+      - '.github/workflows/end-to-end.yml'
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+jobs:
+  endToEnd:
+    name: "End to End Tests (end-to-end build only)"
+    if: ${{ !contains(github.event.head_commit.message, '[skip tests]') }}
+    runs-on: ubuntu-24.04
+    steps:
+      - name: "📥 Checkout repository"
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - name: "☕️ Determine JDKs from .sdkmanrc"
+        # Read both pins out of the files that already declare them, so the workflow cannot
+        # drift from what a developer gets with `sdk env`.
+        id: jdks
+        run: |
+          set -euo pipefail
+          fixture_java=$(grep -E '^java=' end-to-end/legacy-g7-command-plugin/.sdkmanrc | cut -d= -f2)
+          build_java=$(grep -E '^java=' .sdkmanrc | cut -d= -f2)
+          echo "fixture-java=${fixture_java%%.*}" >> "$GITHUB_OUTPUT"
+          echo "build-java=${build_java%%.*}" >> "$GITHUB_OUTPUT"
+          echo "Grails 7 fixture JDK: ${fixture_java}"
+          echo "end-to-end build JDK (from root .sdkmanrc): ${build_java}"
+      - name: "☕️ Setup JDKs"
+        # Both, in one step. The last version listed becomes the default JAVA_HOME (the Grails 8
+        # side); the fixture step below switches to JAVA_HOME_17_X64 for its single invocation.
+        uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
+        with:
+          distribution: liberica
+          java-version: |
+            ${{ steps.jdks.outputs.fixture-java }}
+            ${{ steps.jdks.outputs.build-java }}
+      - name: "🗄️ Restore dependency jar cache"
+        uses: actions/cache@v4
+        with:
+          # Cache only downloaded dependency jars and wrapper distributions, never Grails build outputs.
+          # Keyed by branch version so each release branch maintains its own warm cache.
+          path: |
+            ~/.gradle/caches/modules-2
+            ~/.gradle/wrapper
+          key: gradle-deps-${{ runner.os }}-${{ github.base_ref || github.ref_name }}-${{ hashFiles('**/dependencies.gradle', '**/gradle-wrapper.properties') }}
+          restore-keys: |
+            gradle-deps-${{ runner.os }}-${{ github.base_ref || github.ref_name }}-
+      - name: "🐘 Setup Gradle"
+        uses: gradle/actions/setup-gradle@50e97c2cd7a37755bbfafc9c5b7cafaece252f6e # v6.1.0
+        with:
+          cache-disabled: true # dependency jars are cached by the explicit branch-keyed step above
+          develocity-access-key: ${{ secrets.DEVELOCITY_ACCESS_KEY  }}
+      - name: "📦 Setup: publish grails-gradle to the local repository the tests resolve from"
+        # Both builds publish into the same build/local-maven, and both are needed: the Grails BOM
+        # constrains org.apache.grails.gradle artifacts. grails-forge depends on this same pair of
+        # publish tasks for the applications its tests generate.
+        working-directory: 'grails-gradle'
+        run: ./gradlew publishAllPublicationsToTestCaseMavenRepoRepository -PskipTests --stacktrace
+      - name: "📦 Setup: publish Grails to the local repository the tests resolve from"
+        run: ./gradlew publishAllPublicationsToTestCaseMavenRepoRepository -PskipTests --stacktrace
+      - name: "📦 Setup: build the precompiled Grails 7 / Groovy 4 fixture"
+        working-directory: 'end-to-end/legacy-g7-command-plugin'
+        env:
+          JAVA_HOME: ${{ env.JAVA_HOME_17_X64 }}
+        run: ./gradlew jar --stacktrace
+      - name: "🔍 Verify the fixture really was built on Grails 7 / Groovy 4"
+        working-directory: 'end-to-end/legacy-g7-command-plugin'
+        # A fixture silently built by the wrong toolchain would still pass the suite while
+        # proving nothing, so fail loudly here instead.
+        run: |
+          set -euo pipefail
+          jar=$(ls build/libs/*.jar)
+          unzip -p "$jar" META-INF/MANIFEST.MF | tr -d '\r' > /tmp/fixture-manifest
+          cat /tmp/fixture-manifest
+          grep -q '^Grails-Compile-Version: 7\.' /tmp/fixture-manifest
+          grep -q '^Groovy-Compile-Version: 4\.' /tmp/fixture-manifest
+      - name: "🔍 Setup TestLens"
+        uses: testlens-app/setup-testlens@d96a555133c275a00949d2cc77b70fe9a4242ebf # v1.9.2
+      - name: "🧪 Run the end-to-end tests"
+        # Only the end-to-end build. grails-core's own unit and functional suites are the CI
+        # workflow's job; nothing here re-runs them. The publish steps above are setup, not tests.
+        working-directory: 'end-to-end'
+        run: ./gradlew check --continue --stacktrace
+      - name: "📤 Upload test reports"
+        if: failure()
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        with:
+          name: end-to-end-test-reports
+          path: end-to-end/**/build/reports/tests/**

end-to-end/README.md

@@ -0,0 +1,99 @@
+<!--
+SPDX-License-Identifier: Apache-2.0
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    https://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+-->
+
+# End-to-end tests
+
+Tests that exercise Grails from the outside, where doing so needs something the core build
+cannot provide — a different JDK, a different Grails major, or a real published artifact.
+
+This is its own Gradle build, so the core build never reaches these projects and `./gradlew build`
+at the repository root is unaffected by anything here.
+
+It resolves Grails from the artifacts the core build **publishes**, not by project substitution.
+That is what makes these tests end-to-end: they consume grails-core the way an application does,
+through real poms and Gradle module metadata, including the CLI companion artifacts. The repository
+is `<repository root>/build/local-maven` — the same one `grails-forge` points its generated
+applications at via `GRAILS_REPO_URL`.
+
+## Projects
+
+| Project | What it is |
+|---|---|
+| `legacy-g7-command-plugin` | A **standalone build**, not part of this one. Compiles against published Grails 7 / Groovy 4 to produce a genuine precompiled `grails.dev.commands.ApplicationCommand` binary. |
+| `legacy-commands-plugin` | A Grails 8 plugin whose legacy commands are recompiled under Groovy 5. |
+| `legacy-commands` | A Grails 8 application that consumes both and runs their commands through the registry. |
+
+`legacy-g7-command-plugin` is deliberately excluded from `settings.gradle`. An included build would
+substitute `org.apache.grails:grails-core` for this repository's Groovy 5 project, which is exactly
+the substitution the fixture exists to avoid — it must be compiled by a real Grails 7 toolchain for
+its trait-woven bytecode to prove anything.
+
+## JDKs
+
+The Grails 7 half declares the JDK it needs in a `.sdkmanrc`, rather than a Gradle toolchain, so that
+neither the core build nor a contributor's default environment inherits a second JDK requirement:
+
+| Where | JDK | Why |
+|---|---|---|
+| `legacy-g7-command-plugin/.sdkmanrc` | 17, Gradle 8.14.5 | What Grails 7 pins, so the fixture is built the way a Grails 7 plugin actually was. `gradle-bootstrap` generates this wrapper from that file via its `legacyG7Wrapper` task, rather than copying the shared one. |
+| the repository's root `.sdkmanrc` | 21 | The Grails 8 baseline. This build consumes artifacts from the core build, so it runs on whatever the core build runs on — it deliberately does not re-pin that. |
+
+## Running locally
+
+Three steps, in order. Each fails with an actionable message if a prior one was skipped.
+
+Publish Grails to the repository this build resolves from. Both builds publish into the same
+directory and both are needed — the BOM constrains `org.apache.grails.gradle` artifacts too:
+
+```shell
+(cd grails-gradle && ./gradlew publishAllPublicationsToTestCaseMavenRepoRepository)
+./gradlew publishAllPublicationsToTestCaseMavenRepoRepository
+```
+
+Build the Grails 7 fixture — it is consumed as a prebuilt jar:
+
+```shell
+cd end-to-end/legacy-g7-command-plugin
+sdk env
+./gradlew jar
+```
+
+Run the suite, on the root JDK:
+
+```shell
+sdk env            # from the repository root
+cd end-to-end
+./gradlew check
+```
+
+Re-run the publish whenever you change something in the core build that these tests exercise;
+nothing here can detect that for you, because the whole point is that the build boundary is real.
+
+CI does the same three steps, reading both JDK versions out of the `.sdkmanrc` files so the workflow
+cannot drift from them. See `.github/workflows/end-to-end.yml`.
+
+## Why not `includeBuild('..')`
+
+Composite substitution would win over the local repository and put us back to resolving projects
+instead of artifacts, which is the thing these tests exist not to do. It also cannot express the CLI
+companions: `grails-core-cli` is a secondary capability of `:grails-core` rather than a project, so
+substituting it hits a capability self-conflict.
+
+Published metadata has that solved already — the companion is a first-class module with its own
+publication, and `CliPublishingSupport` rewrites capability requests out of what gets published so
+that external consumers resolve the plain coordinate. Resolving from the repository gets that for
+free; `settings.gradle` uses `exclusiveContent` so every `org.apache.grails` artifact must come from
+the local build and a remote snapshot cannot quietly satisfy the request instead.

end-to-end/build.gradle

@@ -0,0 +1,41 @@
+/*
+ *  Licensed to the Apache Software Foundation (ASF) under one
+ *  or more contributor license agreements.  See the NOTICE file
+ *  distributed with this work for additional information
+ *  regarding copyright ownership.  The ASF licenses this file
+ *  to you under the Apache License, Version 2.0 (the
+ *  "License"); you may not use this file except in compliance
+ *  with the License.  You may obtain a copy of the License at
+ *
+ *    https://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing,
+ *  software distributed under the License is distributed on an
+ *  "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ *  KIND, either express or implied.  See the License for the
+ *  specific language governing permissions and limitations
+ *  under the License.
+ */
+
+def localMavenRepo = rootProject.layout.projectDirectory.dir('../build/local-maven')
+
+subprojects {
+    configurations.configureEach {
+        // Snapshots in the local repository are timestamped and rewritten on every core publish,
+        // so cached metadata would serve a stale one.
+        resolutionStrategy {
+            cacheChangingModulesFor(0, 'seconds')
+            cacheDynamicVersionsFor(0, 'seconds')
+        }
+    }
+
+    tasks.withType(AbstractCompile).configureEach {
+        doFirst {
+            if (!localMavenRepo.asFile.directory) {
+                throw new GradleException('Grails has not been published to the repository this ' +
+                        "build resolves from (${localMavenRepo.asFile}). Run this first, from the " +
+                        'repository root: ./gradlew publishAllPublicationsToTestCaseMavenRepoRepository')
+            }
+        }
+    }
+}

end-to-end/gradle.properties

@@ -0,0 +1,6 @@
+projectVersion=8.0.0-SNAPSHOT
+
+org.gradle.jvmargs=-Dfile.encoding=UTF-8 -Xmx5G
+org.gradle.configuration-cache=false
+org.gradle.caching=true
+org.gradle.parallel=true

end-to-end/gradle/wrapper/gradle-wrapper.jar

@@ -0,0 +1,9 @@
+distributionBase=GRADLE_USER_HOME
+distributionPath=wrapper/dists
+distributionUrl=https\://services.gradle.org/distributions/gradle-9.6.0-bin.zip
+networkTimeout=10000
+retries=0
+retryBackOffMs=500
+validateDistributionUrl=true
+zipStoreBase=GRADLE_USER_HOME
+zipStorePath=wrapper/dists