Enable PMD incrementally across remaining core modules

[jamesfredley]

Summary

A full root PMD baseline with PMD 7.25.0 produced 5,551 findings across 53 source-bearing subprojects after generated files below build/ were excluded. Four subprojects produce clean PMD XML today and can be protected immediately; the remaining modules need incremental cleanup before joining the blocking allowlist.

Reproduction

./gradlew aggregateAnalysisViolations --continue \
  -Pgrails.code-analysis.enabled.pmd=true \
  -Pgrails.code-analysis.ignoreFailures=true

Reports are written under build/reports/code-analysis/pmd/.

Baseline

Largest current groups:

Project	Findings
grails-core	699
grails-datastore-core	698
grails-web-common	585
grails-data-hibernate5-core	549
grails-gsp-core	289
grails-data-mongodb-core	288
grails-encoder	269
grails-datamapping-core	254
grails-converters	213
grails-web-url-mappings	211
Remaining 43 projects	1,496
Total	5,551

The current clean, report-producing baseline is:

• :grails-data-graphql-core
• :grails-data-mongodb-spring-data
• :grails-datasource
• :grails-testing-support-core

:grails-scaffolding, :grails-spring-security, and :grails-spring-security-acl have no PMD-analyzable Java source. Their PMD tasks legitimately produce no XML, so they are not counted as clean or added to blocking enforcement.

Suggested approach

Clean one independently buildable subproject at a time. After a subproject reaches zero findings and produces its expected PMD XML report, add its full project path to grails.code-analysis.enabled.pmd.projects so regressions become blocking immediately.

Do not disable PMD rules globally to clear this backlog. If a rule is invalid for Grails/Groovy-generated Java, document and scope that exception to the affected source set or file pattern.

Acceptance criteria

• Each remaining source-bearing root subproject has zero PMD findings.
• Each cleaned, report-producing subproject is added to the PMD project allowlist in the same change.
• Module tests and aggregateAnalysisViolations pass after every staged addition.