fix: prevent ConcurrentModificationException in parallel configuration cache with lazily registered reports

[Copilot]

With org.gradle.configuration-cache.parallel=true, Gradle's parallel serializer iterates DefaultNamedDomainObjectCollection.UnfilteredIndex.pendingMap (a LinkedHashMap) to write pending providers. Serializing a provider value triggers its realization, which removes the entry from the map mid-iteration → ConcurrentModificationException. This manifests in multi-project builds using the configureEach + register() pattern:

tasks.withType(SpotBugsTask).configureEach {
    reports {
        register('xml') { required = true }
    }
}

Changes

• SpotBugsTask.reports(Action) — replace reports.toList() with reports.matching { true }.toList(). The plain toList() call routes through DefaultDomainObjectCollection.iterator(), which walks only already-realized elements and never calls realizePending(), leaving registered items in pendingMap. matching { } creates a FilteredElementSource whose iterator() calls realizePending() first, fully draining pendingMap before any config-cache serializer touches the container.

• Issue1654.groovy — regression test: two-subproject build with configureEach { reports { register('xml') ... } } and org.gradle.configuration-cache.parallel=true, asserting the cache is stored cleanly on the first run and reused on the second.

[hazendaz]

@copilot Test failed
Issue1654 > reports.register() in configureEach does not cause ConcurrentModificationException with parallel config cache FAILED
org.gradle.testkit.runner.UnexpectedBuildFailure at Issue1654.groovy:100

[Copilot]

@copilot Test failed
Issue1654 > reports.register() in configureEach does not cause ConcurrentModificationException with parallel config cache FAILED
org.gradle.testkit.runner.UnexpectedBuildFa...

Fixed in e2294e4. The root build.gradle used import com.github.spotbugs.snom.SpotBugsTask but the root project didn't apply the SpotBugs plugin, so the class wasn't on the root project's build script compilation classpath — causing a compile error.

Restructured the test to match the existing MultiProjectFunctionalTest pattern: each subproject (sub1, sub2) now has its own build.gradle that uses apply plugin: 'com.github.spotbugs' and configures spotbugsMain { reports { register('xml') { ... } } } directly — no import of SpotBugsTask needed.

[hazendaz]

@copilot Issue1654 > reports.register() does not cause ConcurrentModificationException with parallel config cache FAILED
java.io.FileNotFoundException at Issue1654.groovy:62

[Copilot]

@copilot Issue1654 > reports.register() does not cause ConcurrentModificationException with parallel config cache FAILED
java.io.FileNotFoundException at Issue1654.groovy:62

Fixed in 5dfb099. The subDir (sub1/sub2) didn't exist yet when build.gradle was written into it. Added subDir.mkdirs() before the file creation.

[hazendaz]

@copilot Current errors, see

Issue1654 > reports.register() does not cause ConcurrentModificationException with parallel config cache FAILED
    org.gradle.testkit.runner.UnexpectedBuildFailure at Issue1654.groovy:102

97 tests completed, 1 failed, 6 skipped

Please fix

[Copilot]

@copilot Current errors, see

...

Fixed in 7d63111. The inner Gradle build was failing with Plugin with id 'com.github.spotbugs' not found. — the test had no root build.gradle, so TestKit's withPluginClasspath() injection never initialized the plugin classloader for the subprojects to use apply plugin: 'com.github.spotbugs'. Added a minimal root build.gradle with plugins { id 'com.github.spotbugs' }, matching the pattern used in all other multi-project functional tests.

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

• dl.google.com
  • Triggering command: /usr/lib/jvm/temurin-17-jdk-amd64/bin/java /usr/lib/jvm/temurin-17-jdk-amd64/bin/java --add-opens=java.base/java.lang=ALL-UNNAMED --add-opens=java.base/java.lang.invoke=ALL-UNNAMED --add-opens=java.base/java.util=ALL-UNNAMED --add-opens=java.prefs/java.util.prefs=ALL-UNNAMED --add-exports=jdk.compiler/com.sun.tools.javac.api=ALL-UNNAMED --add-exports=jdk.compiler/com.sun.tools.javac.util=ALL-UNNAMED --add-opens=java.base/java.util=ALL-UNNAMED --add-opens=java.prefs/java.util.prefs=ALL-UNNAMED --add-opens=java.base/java.nio.charset=ALL-UNNAMED --add-opens=java.base/java.net=ALL-UNNAMED --add-opens=java.base/java.util.concurrent.atomic=ALL-UNNAMED --add-opens=java.xml/javax.xml.namespace=ALL-UNNAMED -Xmx4g -Dfile.encoding=UTF-8 -Duser.country -Duser.language=en -Duser.variant -cp /home/REDACTED/.gradle/wrapper/dists/gradle-8.14.4-bin/92wwslzcyst3phie3o264zltu/gradle-8.14.4/lib/gradle-daemon-main-8.14.4.jar (dns block)

If you need me to access, download, or install something from one of these locations, you can either:

• Configure Actions setup steps to set up my environment, which run before the firewall is enabled
• Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
100.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud