Gradle: Replace legacy buildSrc mechanism with included build (#1524)

Motivation: buildSrc is a special-case legacy mechanism. Gradle recommends using an included build named build-logic instead: https://docs.gradle.org/current/userguide/best_practices_structuring_builds.html#favor_composite_builds Changes: - Rename buildSrc/ to build-logic/ - triggers reformatting - Replace occurrences of "buildSrc" with "build-logic" - Include the build-logic build in the main build (via settings.gradle.kts) - Apply convention plugins via plugin IDs instead of type-safe accessors - small tradeoff compared to buildSrc Result: - Faster and more isolated builds - Build logic behaves like a normal build, making it easier to evolve and reason about --------- Co-authored-by: Daniel Chao <dan.chao@apple.com>
2026-06-12 16:44:33 +02:00 · 2026-04-16 05:37:10 +01:00
parent 04a9cc90d2
commit 4faf35a66a
56 changed files with 343 additions and 350 deletions
@@ -0,0 +1,427 @@
+/*
+ * Copyright © 2024-2026 Apple Inc. and the Pkl project authors. All rights reserved.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+@file:Suppress("MemberVisibilityCanBePrivate")
+
+import java.io.File
+import org.gradle.api.Project
+import org.gradle.api.artifacts.VersionCatalog
+import org.gradle.api.artifacts.VersionCatalogsExtension
+import org.gradle.api.attributes.Category
+import org.gradle.api.provider.Provider
+import org.gradle.api.tasks.TaskProvider
+import org.gradle.api.tasks.testing.Test
+import org.gradle.internal.extensions.stdlib.capitalized
+import org.gradle.jvm.toolchain.*
+import org.gradle.kotlin.dsl.*
+import org.gradle.kotlin.dsl.support.serviceOf
+import org.gradle.process.CommandLineArgumentProvider
+
+/**
+ * JVM bytecode target; this is pinned at a reasonable version, because downstream JVM projects
+ * which consume Pkl will need a minimum bytecode level at or above this one.
+ *
+ * Kotlin and Java need matching bytecode targets, so this is expressed as a build setting and
+ * constant default. To override, pass `-DpklJdkToolchain=X` to the Gradle command line, where X is
+ * a major Java version.
+ */
+const val PKL_JVM_TARGET_DEFAULT_MAXIMUM = 17
+
+/**
+ * The Pkl build requires JDK 25+; otherwise, NullAway will not work correctly.
+ *
+ * This is a build-time requirement, not a runtime requirement. To avoid the provisioning of
+ * multiple JDKs and other build issues, keep this value in sync with the JVM toolchain versions in
+ * `build-logic/build.gradle.kts` and `gradle-daemon-jvm.properties`.
+ */
+const val PKL_JDK_VERSION_MIN = 25
+
+/**
+ * The JDK minimum is set to match the bytecode minimum, to guarantee that fat JARs work against the
+ * earliest supported bytecode target.
+ */
+const val PKL_TEST_JDK_MINIMUM = PKL_JVM_TARGET_DEFAULT_MAXIMUM
+
+/**
+ * Maximum JDK version which Pkl is tested with; this should be bumped when new JDK releases are
+ * issued.
+ */
+const val PKL_TEST_JDK_MAXIMUM = 26
+
+/**
+ * If `true`, all JDK releases between [PKL_TEST_JDK_MINIMUM] and [PKL_TEST_JDK_MAXIMUM] are tested.
+ * If `false`, only LTS releases within that range are tested. To override, pass
+ * `-DpklTestAllJdks=true` on the Gradle command line.
+ */
+const val PKL_TEST_ALL_JDKS = false
+
+// `buildInfo` in main build scripts
+// `project.extensions.getByType<BuildInfo>()` in precompiled script plugins
+open class BuildInfo(private val project: Project) {
+  inner class GraalVm(val arch: String) {
+    val homeDir: String by lazy {
+      System.getenv("GRAALVM_HOME") ?: "${System.getProperty("user.home")}/.graalvm"
+    }
+
+    val version: String by lazy { libs.findVersion("graalVm").get().toString() }
+
+    val graalVmJdkVersion: String by lazy { libs.findVersion("graalVmJdkVersion").get().toString() }
+
+    val osName: String by lazy {
+      when {
+        os.isMacOsX -> "macos"
+        os.isLinux -> "linux"
+        os.isWindows -> "windows"
+        else -> throw RuntimeException("${os.familyName} is not supported.")
+      }
+    }
+
+    val baseName: String by lazy {
+      "graalvm-community-jdk-${graalVmJdkVersion}_${osName}-${arch}_bin"
+    }
+
+    val downloadUrl: String by lazy {
+      val extension = if (os.isWindows) "zip" else "tar.gz"
+      "https://github.com/graalvm/graalvm-ce-builds/releases/download/jdk-${graalVmJdkVersion}/$baseName.$extension"
+    }
+
+    val downloadFile: File by lazy {
+      val extension = if (os.isWindows) "zip" else "tar.gz"
+      File(homeDir, "${baseName}.$extension")
+    }
+
+    val installDir: File by lazy { File(homeDir, baseName) }
+
+    val baseDir: String by lazy {
+      if (os.isMacOsX) "$installDir/Contents/Home" else installDir.toString()
+    }
+  }
+
+  /** The target architecture to build, defaulting to the system architecture. */
+  val targetArch by lazy { System.getProperty("pkl.targetArch") ?: arch }
+
+  /** Tells if this is a cross-arch build (e.g. targeting amd64 when on an aarch64 machine). */
+  val isCrossArch by lazy { arch != targetArch }
+
+  /** Tells if cross-arch builds are supported on this machine. */
+  val isCrossArchSupported by lazy { os.isMacOsX }
+
+  /** Whether to build native executables using the musl toolchain or not. */
+  val musl: Boolean by lazy { java.lang.Boolean.getBoolean("pkl.musl") }
+
+  /** Same logic as [org.gradle.internal.os.OperatingSystem#arch], which is protected. */
+  val arch: String by lazy {
+    when (val arch = System.getProperty("os.arch")) {
+      "x86" -> "i386"
+      "x86_64" -> "amd64"
+      "powerpc" -> "ppc"
+      else -> arch
+    }
+  }
+
+  val graalVmAarch64: GraalVm = GraalVm("aarch64")
+
+  val graalVmAmd64: GraalVm = GraalVm("x64")
+
+  val isCiBuild: Boolean by lazy { System.getenv("CI") != null }
+
+  val isReleaseBuild: Boolean by lazy { java.lang.Boolean.getBoolean("releaseBuild") }
+
+  val isNativeArch: Boolean by lazy { java.lang.Boolean.getBoolean("nativeArch") }
+
+  val jvmTarget: Int by lazy {
+    System.getProperty("pklJvmTarget")?.toInt() ?: PKL_JVM_TARGET_DEFAULT_MAXIMUM
+  }
+
+  // JPMS exports for Truffle; needed on some versions of Java, and transitively within some JARs.
+  private val jpmsExports =
+    arrayOf(
+      "org.graalvm.truffle/com.oracle.truffle.api.exception=ALL-UNNAMED",
+      "org.graalvm.truffle/com.oracle.truffle.api=ALL-UNNAMED",
+      "org.graalvm.truffle/com.oracle.truffle.api.nodes=ALL-UNNAMED",
+      "org.graalvm.truffle/com.oracle.truffle.api.source=ALL-UNNAMED",
+    )
+
+  // Extra JPMS modules forced onto the module path via `--add-modules` in some cases.
+  private val jpmsAddModules = arrayOf("jdk.unsupported")
+
+  // Formats `jpmsExports` for use in JAR manifest attributes.
+  val jpmsExportsForJarManifest: String by lazy {
+    jpmsExports.joinToString(" ") { it.substringBefore("=") }
+  }
+
+  // Formats `jpmsExports` for use on the command line with `--add-exports`.
+  val jpmsExportsForAddExportsFlags: Collection<String> by lazy {
+    jpmsExports.map { "--add-exports=$it" }
+  }
+
+  // Formats `jpmsAddModules` for use on the command line with `--add-modules`.
+  val jpmsAddModulesFlags: Collection<String> by lazy { jpmsAddModules.map { "--add-modules=$it" } }
+
+  // JVM properties to set during testing.
+  val testProperties =
+    mapOf<String, Any>(
+      // @TODO: this should be removed once pkl supports JPMS as a true Java Module.
+      "polyglotimpl.DisableClassPathIsolation" to true
+    )
+
+  val jdkVendor: JvmVendorSpec = JvmVendorSpec.ADOPTIUM
+
+  val jdkToolchainVersion: JavaLanguageVersion by lazy {
+    JavaLanguageVersion.of(System.getProperty("pklJdkToolchain")?.toInt() ?: PKL_JDK_VERSION_MIN)
+  }
+
+  val jdkTestFloor: JavaLanguageVersion by lazy { JavaLanguageVersion.of(PKL_TEST_JDK_MINIMUM) }
+
+  val jdkTestCeiling: JavaLanguageVersion by lazy { JavaLanguageVersion.of(PKL_TEST_JDK_MAXIMUM) }
+
+  val testAllJdks: Boolean by lazy {
+    // By default, Pkl is tested against LTS JDK releases within the bounds of `PKL_TEST_JDK_TARGET`
+    // and `PKL_TEST_JDK_MAXIMUM`. To test against the full suite of JDK versions, past and present,
+    // set `-DpklTestAllJdks=true` on the Gradle command line. This results in non-LTS releases, old
+    // releases, and "experimental releases" (newer than the toolchain version) being included in
+    // the default `check` suite.
+    System.getProperty("pklTestAllJdks")?.toBoolean() ?: PKL_TEST_ALL_JDKS
+  }
+
+  val testExperimentalJdks: Boolean by lazy {
+    System.getProperty("pklTestFutureJdks")?.toBoolean() ?: false
+  }
+
+  val testJdkVendors: Sequence<JvmVendorSpec> by lazy {
+    // By default, only Adoptium is tested during multi-JDK testing. Flip `-DpklTestAllVendors=true`
+    // to additionally test against GraalVM and Oracle.
+    when (System.getProperty("pklTestAllVendors")?.toBoolean()) {
+      true -> sequenceOf(JvmVendorSpec.ADOPTIUM, JvmVendorSpec.GRAAL_VM, JvmVendorSpec.ORACLE)
+      else -> sequenceOf(JvmVendorSpec.ADOPTIUM)
+    }
+  }
+
+  private val isArmWindows: Boolean
+    get() {
+      if (!os.isWindows) {
+        return false
+      }
+      // System.getProperty("os.arch") returns the architecture of the JVM, not the host OS.
+      val procArch = System.getenv("PROCESSOR_ARCHITECTURE")
+      return "ARM64".equals(procArch, ignoreCase = true)
+    }
+
+  // Assembles a collection of JDK versions which tests can be run against, considering ancillary
+  // parameters like `testAllJdks` and `testExperimentalJdks`.
+  val jdkTestRange: Collection<JavaLanguageVersion> by lazy {
+    if (isArmWindows) {
+      // Java toolchains does not work on ARM windows: https://github.com/gradle/gradle/issues/29807
+      // prevent creating tasks to test different JDKs if developing on a Windows ARM machine.
+      return@lazy listOf()
+    }
+    JavaVersionRange.inclusive(jdkTestFloor, jdkTestCeiling).toList()
+  }
+
+  val JavaLanguageVersion.isEnabled: Boolean
+    get() = isVersionEnabled(this)
+
+  fun isVersionEnabled(version: JavaLanguageVersion): Boolean {
+    return when {
+      testAllJdks -> true
+      multiJdkTesting -> JavaVersionRange.isLTS(version)
+      testExperimentalJdks -> version > jdkToolchainVersion
+      else -> false
+    }
+  }
+
+  private fun JavaToolchainSpec.pklJdkToolchain() {
+    languageVersion.set(jdkToolchainVersion)
+    vendor.set(jdkVendor)
+  }
+
+  private fun labelForVendor(vendor: JvmVendorSpec): String =
+    when (vendor) {
+      JvmVendorSpec.AZUL -> "Zulu"
+      JvmVendorSpec.GRAAL_VM -> "GraalVm"
+      JvmVendorSpec.ORACLE -> "Oracle"
+      JvmVendorSpec.ADOPTIUM -> "Adoptium"
+      else -> error("Unrecognized JDK vendor: $vendor")
+    }
+
+  private fun testNamer(baseName: () -> String): (JavaLanguageVersion, JvmVendorSpec?) -> String =
+    { jdkTarget, vendor ->
+      val targetToken =
+        when (vendor) {
+          null -> "Jdk${jdkTarget.asInt()}"
+          else -> "Jdk${jdkTarget.asInt()}${labelForVendor(vendor).capitalized()}"
+        }
+      if (jdkTarget > jdkToolchainVersion) {
+        // test targets above the toolchain target are considered "experimental".
+        "${baseName()}${targetToken}Experimental"
+      } else {
+        "${baseName()}${targetToken}"
+      }
+    }
+
+  @Suppress("UnstableApiUsage")
+  fun multiJdkTestingWith(
+    templateTask: TaskProvider<out Test>,
+    configurator: MultiJdkTestConfigurator = {},
+  ): Iterable<Provider<out Any>> =
+    with(project) {
+      val isMultiVendor = testJdkVendors.count() > 1
+      val baseNameProvider = { templateTask.get().name }
+      val namer = testNamer(baseNameProvider)
+      val applyConfig: MultiJdkTestConfigurator = { (version, jdk) ->
+        // 1) copy configurations from the template task
+        templateTask.get().let { template ->
+          // copy explicit dependencies not inferred from task inputs
+          dependsOn(template.dependsOn)
+          classpath = template.classpath
+          testClassesDirs = template.testClassesDirs
+          jvmArgs.addAll(template.jvmArgs)
+          jvmArgumentProviders.addAll(template.jvmArgumentProviders)
+          forkEvery = template.forkEvery
+          maxParallelForks = template.maxParallelForks
+          minHeapSize = template.minHeapSize
+          maxHeapSize = template.maxHeapSize
+          exclude(template.excludes)
+          template.systemProperties.forEach { prop -> systemProperty(prop.key, prop.value) }
+        }
+
+        // 2) assign launcher
+        javaLauncher = jdk
+
+        // 3) dispatch the user's configurator
+        configurator(version to jdk)
+      }
+
+      serviceOf<JavaToolchainService>().let { toolchains ->
+        jdkTestRange
+          .flatMap { targetVersion ->
+            // multiply out by jdk vendor
+            testJdkVendors.map { vendor -> (targetVersion to vendor) }
+          }
+          .mapNotNull { (jdkTarget, vendor) ->
+            if (jdkToolchainVersion == jdkTarget) {
+              tasks.register(namer(jdkTarget, vendor)) {
+                // alias to `test`
+                dependsOn(templateTask)
+                group = Category.VERIFICATION
+                description =
+                  "Alias for regular '${baseNameProvider()}' task, on JDK ${jdkTarget.asInt()}"
+              }
+            } else {
+              // Always register and enable the task so it can be run explicitly,
+              // but only return it if it should be included in "check".
+              val task =
+                tasks.register(namer(jdkTarget, vendor.takeIf { isMultiVendor }), Test::class) {
+                  group = Category.VERIFICATION
+                  description = "Run tests against JDK ${jdkTarget.asInt()}"
+                  applyConfig(jdkTarget to toolchains.launcherFor { languageVersion = jdkTarget })
+                  // fix: on jdk17, we must force the polyglot module on to the modulepath
+                  if (jdkTarget.asInt() == 17)
+                    jvmArgumentProviders.add(
+                      CommandLineArgumentProvider {
+                        buildList { listOf("--add-modules=org.graalvm.polyglot") }
+                      }
+                    )
+                }
+              task.takeIf { jdkTarget.isEnabled }
+            }
+          }
+          .toList()
+      }
+    }
+
+  val javaCompiler: Provider<JavaCompiler> by lazy {
+    project.serviceOf<JavaToolchainService>().let { toolchainService ->
+      toolchainService.compilerFor { pklJdkToolchain() }
+    }
+  }
+
+  val javaTestLauncher: Provider<JavaLauncher> by lazy {
+    project.serviceOf<JavaToolchainService>().let { toolchainService ->
+      toolchainService.launcherFor { pklJdkToolchain() }
+    }
+  }
+
+  val multiJdkTesting: Boolean by lazy {
+    // Test Pkl against a full range of JDK versions, past and present, within the
+    // supported bounds of `PKL_TEST_JDK_TARGET` and `PKL_TEST_JDK_MAXIMUM`.
+    //
+    // In CI, this defaults to `true` to catch potential cross-JDK compat regressions or other bugs.
+    // In local dev, this defaults to `false` to speed up the build and reduce contributor load.
+    System.getProperty("pklMultiJdkTesting")?.toBoolean() ?: isCiBuild
+  }
+
+  val hasMuslToolchain: Boolean by lazy {
+    // see .github/scripts/install_musl.sh
+    File(System.getProperty("user.home"), "staticdeps/bin/x86_64-linux-musl-gcc").exists()
+  }
+
+  val os: org.gradle.internal.os.OperatingSystem by lazy {
+    org.gradle.internal.os.OperatingSystem.current()
+  }
+
+  // could be `commitId: Provider<String> = project.provider { ... }`
+  val commitId: String by lazy {
+    // allow -DcommitId=abc123 for build environments that don't have git.
+    System.getProperty("commitId").let { if (it != null) return@lazy it }
+    // only run command once per build invocation
+    if (project.path == project.rootProject.path) {
+      val process =
+        ProcessBuilder()
+          .command("git", "rev-parse", "--short", "HEAD")
+          .directory(project.rootDir)
+          .start()
+      process.waitFor().also { exitCode ->
+        if (exitCode == -1) throw RuntimeException(process.errorStream.reader().readText())
+      }
+      process.inputStream.reader().readText().trim()
+    } else {
+      project.rootProject.extensions.getByType(BuildInfo::class.java).commitId
+    }
+  }
+
+  val commitish: String by lazy { if (isReleaseBuild) project.version.toString() else commitId }
+
+  val pklVersion: String by lazy {
+    if (isReleaseBuild) {
+      project.version.toString()
+    } else {
+      project.version.toString().replace("-SNAPSHOT", "-dev+$commitId")
+    }
+  }
+
+  val pklVersionNonUnique: String by lazy {
+    if (isReleaseBuild) {
+      project.version.toString()
+    } else {
+      project.version.toString().replace("-SNAPSHOT", "-dev")
+    }
+  }
+
+  // https://melix.github.io/blog/2021/03/version-catalogs-faq.html#_but_how_can_i_use_the_catalog_in_em_plugins_em_defined_in_code_buildsrc_code
+  val libs: VersionCatalog by lazy {
+    project.extensions.getByType<VersionCatalogsExtension>().named("libs")
+  }
+
+  init {
+    if (!isReleaseBuild) {
+      project.version = "${project.version}-SNAPSHOT"
+    }
+  }
+}
+
+// Shape of a function which is applied to configure multi-JDK testing.
+private typealias MultiJdkTestConfigurator =
+  Test.(Pair<JavaLanguageVersion, Provider<JavaLauncher>>) -> Unit
@@ -0,0 +1,73 @@
+/*
+ * Copyright © 2024-2026 Apple Inc. and the Pkl project authors. All rights reserved.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+import org.gradle.api.DefaultTask
+import org.gradle.api.file.RegularFileProperty
+import org.gradle.api.provider.ListProperty
+import org.gradle.api.tasks.Input
+import org.gradle.api.tasks.InputFile
+import org.gradle.api.tasks.OutputFile
+import org.gradle.api.tasks.TaskAction
+
+/**
+ * Builds a self-contained Pkl CLI Jar that is directly executable on Windows, macOS, and Linux.
+ *
+ * For direct execution, the `java` command must be on the PATH.
+ *
+ * Technique borrowed from [Mill](https://mill-build.org/blog/5-executable-jars.html).
+ */
+abstract class ExecutableJar : DefaultTask() {
+  @get:InputFile abstract val inJar: RegularFileProperty
+
+  @get:OutputFile abstract val outJar: RegularFileProperty
+
+  @get:Input abstract val jvmArgs: ListProperty<String>
+
+  @TaskAction
+  @Suppress("unused")
+  fun buildJar() {
+    val inFile = inJar.get().asFile
+    val outFile = outJar.get().asFile
+    val escapedJvmArgs = jvmArgs.get().joinToString(separator = " ") { "\"$it\"" }
+    val unixStartScript =
+      """
+      @ 2>/dev/null # 2>nul & echo off & goto BOF
+      :
+      exec java $escapedJvmArgs -jar "$0" "$@"
+      exit
+      """
+        .trimIndent()
+    val windowsStartScript =
+      """
+      :BOF
+      setlocal
+      @echo off
+      java $escapedJvmArgs -jar "%~dpnx0" %*
+      endlocal
+      exit /B %errorlevel%
+      """
+        .trimIndent()
+        // need crlf endings for Windows portion of script
+        .replace("\n", "\r\n")
+    val startScript = unixStartScript + "\r\n" + windowsStartScript + "\r\n".repeat(3)
+    outFile.outputStream().use { outStream ->
+      startScript.byteInputStream().use { it.copyTo(outStream) }
+      inFile.inputStream().use { it.copyTo(outStream) }
+    }
+
+    // chmod a+x
+    outFile.setExecutable(true, false)
+  }
+}
@@ -0,0 +1,49 @@
+/*
+ * Copyright © 2025-2026 Apple Inc. and the Pkl project authors. All rights reserved.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+import org.gradle.api.provider.Property
+
+abstract class ExecutableSpec {
+  /** The main entrypoint Java class of the executable. */
+  abstract val mainClass: Property<String>
+
+  /**
+   * The name of the native executable.
+   *
+   * Not required if not building a native executable.
+   */
+  abstract val name: Property<String>
+
+  /** The name of the Java executable. */
+  abstract val javaName: Property<String>
+
+  /** The name of the executable that shows in the description when published to Maven. */
+  abstract val documentationName: Property<String>
+
+  /**
+   * The base name of the Maven publication.
+   *
+   * This becomes the base name of the Artifact ID, with the os and arch suffixed.
+   *
+   * For example, `pkl` becomes `pkl-macos-aarch` for the macOS/aarch64 variant.
+   */
+  abstract val publicationName: Property<String>
+
+  /** The name of the artifact ID for the Java executable. */
+  abstract val javaPublicationName: Property<String>
+
+  /** The website for this executable. */
+  abstract val website: Property<String>
+}
@@ -0,0 +1,22 @@
+/*
+ * Copyright © 2024-2026 Apple Inc. and the Pkl project authors. All rights reserved.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+import org.gradle.util.GradleVersion
+
+open class GradlePluginTests {
+  lateinit var minGradleVersion: GradleVersion
+  lateinit var maxGradleVersion: GradleVersion
+  var skippedGradleVersions: List<GradleVersion> = listOf()
+}
@@ -0,0 +1,88 @@
+/*
+ * Copyright © 2024-2026 Apple Inc. and the Pkl project authors. All rights reserved.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+import groovy.json.JsonSlurper
+import java.net.URI
+import org.gradle.util.GradleVersion
+
+@Suppress("unused")
+class GradleVersionInfo(json: Map<String, Any>) {
+  val version: String by json
+
+  val gradleVersion: GradleVersion by lazy { GradleVersion.version(version) }
+
+  val isReleaseVersion: Boolean by lazy {
+    // for some reason, `gradleVersion == gradleVersion.baseVersion` is a compile error
+    gradleVersion.version == gradleVersion.baseVersion.version
+  }
+
+  val buildTime: String by json
+
+  val current: Boolean by json
+
+  val snapshot: Boolean by json
+
+  val nightly: Boolean by json
+
+  val releaseNightly: Boolean by json
+
+  val activeRc: Boolean by json
+
+  val rcFor: String by json
+
+  val milestoneFor: String by json
+
+  val broken: Boolean by json
+
+  val downloadUrl: String by json
+
+  val checksumUrl: String by json
+
+  val wrapperChecksumUrl: String by json
+
+  companion object {
+    private fun fetchAll(): List<GradleVersionInfo> =
+      fetchMultiple("https://services.gradle.org/versions/all")
+
+    fun fetchReleases(): List<GradleVersionInfo> = fetchAll().filter { it.isReleaseVersion }
+
+    fun fetchCurrent(): GradleVersionInfo =
+      fetchSingle("https://services.gradle.org/versions/current")
+
+    fun fetchRc(): GradleVersionInfo? =
+      fetchSingleOrNull("https://services.gradle.org/versions/release-candidate")
+
+    fun fetchNightly(): GradleVersionInfo =
+      fetchSingle("https://services.gradle.org/versions/nightly")
+
+    private fun fetchSingle(url: String): GradleVersionInfo {
+      @Suppress("UNCHECKED_CAST")
+      return GradleVersionInfo(JsonSlurper().parse(URI(url).toURL()) as Map<String, Any>)
+    }
+
+    private fun fetchSingleOrNull(url: String): GradleVersionInfo? {
+      @Suppress("UNCHECKED_CAST")
+      val json = JsonSlurper().parse(URI(url).toURL()) as Map<String, Any>
+      return if (json.isEmpty()) null else GradleVersionInfo(json)
+    }
+
+    private fun fetchMultiple(url: String): List<GradleVersionInfo> {
+      @Suppress("UNCHECKED_CAST")
+      return (JsonSlurper().parse(URI(url).toURL()) as List<Map<String, Any>>).map {
+        GradleVersionInfo(it)
+      }
+    }
+  }
+}
@@ -0,0 +1,21 @@
+/*
+ * Copyright © 2024-2026 Apple Inc. and the Pkl project authors. All rights reserved.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+import org.gradle.api.Project
+import org.gradle.api.file.FileCollection
+
+open class HtmlValidator(project: Project) {
+  var sources: FileCollection = project.files()
+}
@@ -0,0 +1,91 @@
+/*
+ * Copyright © 2024-2026 Apple Inc. and the Pkl project authors. All rights reserved.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+import java.nio.file.Files
+import java.nio.file.Paths
+import java.nio.file.StandardCopyOption
+import java.util.*
+import javax.inject.Inject
+import kotlin.io.path.createDirectories
+import org.gradle.api.DefaultTask
+import org.gradle.api.internal.file.FileOperations
+import org.gradle.api.provider.Property
+import org.gradle.api.tasks.Input
+import org.gradle.api.tasks.TaskAction
+import org.gradle.process.ExecOperations
+
+abstract class InstallGraalVm
+@Inject
+constructor(
+  private val fileOperations: FileOperations,
+  private val execOperations: ExecOperations,
+) : DefaultTask() {
+  @get:Input abstract val graalVm: Property<BuildInfo.GraalVm>
+
+  init {
+    @Suppress("LeakingThis") onlyIf("GraalVM not installed") { !graalVm.get().installDir.exists() }
+  }
+
+  @TaskAction
+  @Suppress("unused")
+  fun run() {
+    // minimize chance of corruption by extract-to-random-dir-and-flip-symlink
+    val distroDir = Paths.get(graalVm.get().homeDir, UUID.randomUUID().toString())
+    try {
+      distroDir.createDirectories()
+      println("Extracting ${graalVm.get().downloadFile} into $distroDir")
+      // faster and more reliable than Gradle's `copy { from tarTree() }`
+      execOperations.exec {
+        workingDir = distroDir.toFile()
+        executable = "tar"
+        args("--strip-components=1", "-xzf", graalVm.get().downloadFile)
+      }
+
+      val os = org.gradle.internal.os.OperatingSystem.current()
+      val distroBinDir =
+        if (os.isMacOsX) distroDir.resolve("Contents/Home/bin") else distroDir.resolve("bin")
+
+      println("Installing native-image into $distroDir")
+      val gvmVersionMajor =
+        requireNotNull(graalVm.get().version.split(".").first().toIntOrNull()) {
+          "Invalid GraalVM JDK version: ${graalVm.get().graalVmJdkVersion}"
+        }
+      if (gvmVersionMajor < 24) {
+        execOperations.exec {
+          val executableName = if (os.isWindows) "gu.cmd" else "gu"
+          executable = distroBinDir.resolve(executableName).toString()
+          args("install", "--no-progress", "native-image")
+        }
+      }
+
+      println("Creating symlink ${graalVm.get().installDir} for $distroDir")
+      val tempLink = Paths.get(graalVm.get().homeDir, UUID.randomUUID().toString())
+      Files.createSymbolicLink(tempLink, distroDir)
+      try {
+        Files.move(tempLink, graalVm.get().installDir.toPath(), StandardCopyOption.ATOMIC_MOVE)
+      } catch (e: Exception) {
+        try {
+          fileOperations.delete(tempLink.toFile())
+        } catch (ignored: Exception) {}
+        throw e
+      }
+    } catch (e: Exception) {
+      try {
+        fileOperations.delete(distroDir)
+      } catch (ignored: Exception) {}
+      throw e
+    }
+  }
+}
@@ -0,0 +1,65 @@
+/*
+ * Copyright © 2024-2026 Apple Inc. and the Pkl project authors. All rights reserved.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+@file:Suppress("MemberVisibilityCanBePrivate")
+
+import java.util.*
+import org.gradle.jvm.toolchain.JavaLanguageVersion
+
+typealias JavaVersionPair = Pair<JavaLanguageVersion, JavaLanguageVersion>
+
+// All LTS releases.
+private val ltsReleases =
+  sortedSetOf(
+    JavaLanguageVersion.of(8),
+    JavaLanguageVersion.of(11),
+    JavaLanguageVersion.of(17),
+    JavaLanguageVersion.of(21),
+    JavaLanguageVersion.of(25),
+  )
+
+/** Describes an inclusive range of JVM versions, based on the [JavaLanguageVersion] type. */
+@JvmInline
+value class JavaVersionRange private constructor(private val bounds: JavaVersionPair) :
+  Iterable<JavaLanguageVersion> {
+  @Suppress("unused")
+  companion object {
+    fun isLTS(version: JavaLanguageVersion): Boolean = version in ltsReleases
+
+    fun inclusive(floor: JavaLanguageVersion, ceiling: JavaLanguageVersion): JavaVersionRange =
+      JavaVersionRange(floor to ceiling)
+
+    fun startingAt(floor: JavaLanguageVersion): JavaVersionRange =
+      inclusive(floor, JavaLanguageVersion.of(PKL_TEST_JDK_MAXIMUM))
+
+    fun upTo(ceiling: JavaLanguageVersion): JavaVersionRange =
+      inclusive(JavaLanguageVersion.of(PKL_TEST_JDK_MINIMUM), ceiling)
+  }
+
+  operator fun contains(version: JavaLanguageVersion): Boolean =
+    version >= bounds.first && version <= bounds.second
+
+  fun asSequence(): Sequence<JavaLanguageVersion> = sequence {
+    var current = bounds.first
+    while (current <= bounds.second) {
+      yield(current)
+      current = JavaLanguageVersion.of(current.asInt() + 1)
+    }
+  }
+
+  fun asSortedSet(): SortedSet<JavaLanguageVersion> = asSequence().toSortedSet()
+
+  override fun iterator(): Iterator<JavaLanguageVersion> = asSortedSet().iterator()
+}
@@ -0,0 +1,130 @@
+/*
+ * Copyright © 2024-2026 Apple Inc. and the Pkl project authors. All rights reserved.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+import java.io.File
+import java.util.regex.Matcher
+import java.util.regex.Pattern
+import org.gradle.api.DefaultTask
+import org.gradle.api.file.ConfigurableFileCollection
+import org.gradle.api.file.FileVisitDetails
+import org.gradle.api.file.RegularFileProperty
+import org.gradle.api.provider.ListProperty
+import org.gradle.api.provider.MapProperty
+import org.gradle.api.tasks.Input
+import org.gradle.api.tasks.InputFiles
+import org.gradle.api.tasks.OutputFile
+import org.gradle.api.tasks.TaskAction
+import org.gradle.kotlin.dsl.listProperty
+import org.gradle.kotlin.dsl.mapProperty
+
+open class MergeSourcesJars : DefaultTask() {
+  @get:InputFiles val inputJars: ConfigurableFileCollection = project.objects.fileCollection()
+
+  @get:InputFiles
+  val mergedBinaryJars: ConfigurableFileCollection = project.objects.fileCollection()
+
+  @get:Input val relocatedPackages: MapProperty<String, String> = project.objects.mapProperty()
+
+  @get:Input
+  var sourceFileExtensions: ListProperty<String> =
+    project.objects.listProperty<String>().convention(listOf(".java", ".kt"))
+
+  @get:OutputFile val outputJar: RegularFileProperty = project.objects.fileProperty()
+
+  @TaskAction
+  @Suppress("unused")
+  fun merge() {
+    val binaryPaths = collectBinaryPaths()
+
+    val relocatedPkgs = relocatedPackages.get()
+
+    val relocatedPaths =
+      relocatedPkgs.entries.associate { (key, value) -> toPath(key) to toPath(value) }
+
+    // use negative lookbehind to match any that don't precede with
+    // a word or a period character. should catch most cases.
+    val importPattern =
+      Pattern.compile(
+        "(?<!([\\w.]))(" + relocatedPkgs.keys.joinToString("|") { it.replace(".", "\\.") } + ")"
+      )
+
+    val sourceFileExts = sourceFileExtensions.get()
+
+    val outDir = this.temporaryDir
+
+    for (jar in inputJars) {
+      // as of Gradle 2.4, doesn't visit dirs despite the claims
+      project.zipTree(jar).visit {
+        val details = this
+        if (details.isDirectory) return@visit
+
+        var path = details.relativePath.parent!!.pathString
+        val relocatedPath = relocatedPaths.keys.find { path.startsWith(it) }
+        if (relocatedPath != null) {
+          path = path.replace(relocatedPath, relocatedPaths.getValue(relocatedPath))
+        }
+        // conservative shrinking
+        if (!binaryPaths.contains(path)) return@visit
+
+        val outFile = File("$outDir/$path/${details.file.name}")
+        outFile.parentFile.mkdirs()
+
+        if (sourceFileExts.any { details.file.name.endsWith(it) }) {
+          val oldContents = details.file.readText(Charsets.UTF_8)
+          val newContents = fixImports(relocatedPkgs, details, oldContents, importPattern)
+          outFile.writeText(newContents, Charsets.UTF_8)
+        } else {
+          details.copyTo(outFile)
+        }
+      }
+    }
+
+    project.ant.invokeMethod("jar", mapOf("basedir" to outDir, "destfile" to outputJar.get()))
+  }
+
+  private fun collectBinaryPaths(): Set<String> {
+    val result = mutableSetOf<String>()
+    for (jar in mergedBinaryJars) {
+      // as of Gradle 2.4 doesn't visit dirs despite the claims
+      project.zipTree(jar).visit {
+        val details = this
+        if (details.isDirectory) return@visit // avoid adding empty dirs
+        result.add(details.relativePath.parent!!.pathString)
+      }
+    }
+    return result
+  }
+
+  private fun fixImports(
+    relocatedPkgs: Map<String, String>,
+    details: FileVisitDetails,
+    sourceText: String,
+    importPattern: Pattern,
+  ): String {
+    val matcher = importPattern.matcher(sourceText)
+    val buffer = StringBuffer()
+    logger.debug("Inspecting file: {}", details.relativePath)
+    while (matcher.find()) {
+      val newStat = relocatedPkgs[matcher.group(2)]
+      logger.debug("Old: {}", matcher.group())
+      logger.debug("New: {}", newStat)
+      matcher.appendReplacement(buffer, Matcher.quoteReplacement(newStat))
+    }
+    matcher.appendTail(buffer)
+    return buffer.toString()
+  }
+
+  private fun toPath(packageName: String): String = packageName.replace(".", "/")
+}
@@ -0,0 +1,170 @@
+/*
+ * Copyright © 2025-2026 Apple Inc. and the Pkl project authors. All rights reserved.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+import javax.inject.Inject
+import org.gradle.api.DefaultTask
+import org.gradle.api.file.ConfigurableFileCollection
+import org.gradle.api.provider.ListProperty
+import org.gradle.api.provider.Property
+import org.gradle.api.provider.Provider
+import org.gradle.api.services.BuildService
+import org.gradle.api.services.BuildServiceParameters
+import org.gradle.api.tasks.ClasspathNormalizer
+import org.gradle.api.tasks.Input
+import org.gradle.api.tasks.InputFiles
+import org.gradle.api.tasks.OutputFile
+import org.gradle.api.tasks.PathSensitivity
+import org.gradle.api.tasks.TaskAction
+import org.gradle.kotlin.dsl.registerIfAbsent
+import org.gradle.kotlin.dsl.withNormalizer
+import org.gradle.process.ExecOperations
+
+enum class Architecture {
+  AMD64,
+  AARCH64,
+}
+
+abstract class NativeImageBuildService : BuildService<BuildServiceParameters.None>
+
+abstract class NativeImageBuild : DefaultTask() {
+  @get:Input abstract val imageName: Property<String>
+
+  @get:Input abstract val extraNativeImageArgs: ListProperty<String>
+
+  @get:Input abstract val arch: Property<Architecture>
+
+  @get:Input abstract val mainClass: Property<String>
+
+  @get:InputFiles abstract val classpath: ConfigurableFileCollection
+
+  private val outputDir = project.layout.buildDirectory.dir("executable")
+
+  @get:OutputFile val outputFile = outputDir.flatMap { it.file(imageName) }
+
+  @get:Inject protected abstract val execOperations: ExecOperations
+
+  private val graalVm: Provider<BuildInfo.GraalVm> = arch.map { a ->
+    when (a) {
+      Architecture.AMD64 -> buildInfo.graalVmAmd64
+      Architecture.AARCH64 -> buildInfo.graalVmAarch64
+    }
+  }
+
+  private val buildInfo: BuildInfo = project.extensions.getByType(BuildInfo::class.java)
+
+  private val nativeImageCommandName =
+    if (buildInfo.os.isWindows) "native-image.cmd" else "native-image"
+
+  private val nativeImageExecutable = graalVm.map { "${it.baseDir}/bin/$nativeImageCommandName" }
+
+  private val extraArgsFromProperties by lazy {
+    System.getProperties()
+      .filter { it.key.toString().startsWith("pkl.native") }
+      .map { "${it.key}=${it.value}".substring("pkl.native".length) }
+  }
+
+  private val buildService =
+    project.gradle.sharedServices.registerIfAbsent(
+      "nativeImageBuildService",
+      NativeImageBuildService::class,
+    ) {
+      maxParallelUsages.set(1)
+    }
+
+  init {
+    // ensure native-image builds run in serial (prevent `gw buildNative` from consuming all host
+    // CPU resources).
+    usesService(buildService)
+
+    group = "build"
+
+    inputs
+      .files(classpath)
+      .withPropertyName("runtimeClasspath")
+      .withNormalizer(ClasspathNormalizer::class)
+    inputs
+      .files(nativeImageExecutable)
+      .withPropertyName("graalVmNativeImage")
+      .withPathSensitivity(PathSensitivity.ABSOLUTE)
+  }
+
+  @TaskAction
+  @Suppress("unused")
+  protected fun run() {
+    execOperations.exec {
+      val exclusions =
+        listOf(buildInfo.libs.findLibrary("graalSdk").get()).map { it.get().module.name }
+
+      executable = nativeImageExecutable.get()
+      workingDir(outputDir)
+
+      args = buildList {
+        // must be emitted before any experimental options are used
+        add("-H:+UnlockExperimentalVMOptions")
+        // currently gives a deprecation warning, but we've been told
+        // that the "initialize everything at build time" *CLI* option is likely here to stay
+        add("--initialize-at-build-time=")
+        // needed for messagepack-java (see https://github.com/msgpack/msgpack-java/issues/600)
+        add("--initialize-at-run-time=org.msgpack.core.buffer.DirectBufferAccess")
+        // needed for jline-terminal-jni
+        add("--initialize-at-run-time=org.jline.nativ,org.jline.terminal.impl.jni")
+        add("--no-fallback")
+        add("-H:IncludeResources=org/pkl/core/stdlib/.*\\.pkl")
+        add("-H:IncludeResources=org/jline/utils/.*")
+        add("-H:IncludeResourceBundles=org.pkl.core.errorMessages")
+        add("-H:IncludeResourceBundles=org.pkl.parser.errorMessages")
+        add("-H:IncludeResources=org/pkl/commons/cli/PklCARoots.pem")
+        add("-H:Class=${mainClass.get()}")
+        add("-o")
+        add(imageName.get())
+        // the actual limit (currently) used by native-image is this number + 1400 (idea is to
+        // compensate for Truffle's own nodes)
+        add("-H:MaxRuntimeCompileMethods=1800")
+        add("-H:+EnforceMaxRuntimeCompileMethods")
+        add("--enable-url-protocols=http,https")
+        add("-H:+ReportExceptionStackTraces")
+        // disable automatic support for JVM CLI options (puts our main class in full control of
+        // argument parsing)
+        add("-H:-ParseRuntimeOptions")
+        // quick build mode: 40% faster compilation, 20% smaller (but presumably also slower)
+        // executable
+        if (!buildInfo.isReleaseBuild) {
+          add("-Ob")
+        }
+        if (buildInfo.isNativeArch) {
+          add("-march=native")
+        } else {
+          add("-march=compatibility")
+        }
+        // native-image rejects non-existing class path entries -> filter
+        add("--class-path")
+        val pathInput = classpath.filter {
+          it.exists() && !exclusions.any { exclude -> it.name.contains(exclude) }
+        }
+        add(pathInput.asPath)
+        // make sure dev machine stays responsive (15% slowdown on my laptop)
+        val processors =
+          Runtime.getRuntime().availableProcessors() /
+            if (buildInfo.os.isMacOsX && !buildInfo.isCiBuild) 4 else 1
+        add("-J-XX:ActiveProcessorCount=${processors}")
+        // Pass through all `HOMEBREW_` prefixed environment variables to allow build with shimmed
+        // tools.
+        addAll(environment.keys.filter { it.startsWith("HOMEBREW_") }.map { "-E$it" })
+        addAll(extraNativeImageArgs.get())
+        addAll(extraArgsFromProperties)
+      }
+    }
+  }
+}
@@ -0,0 +1,58 @@
+/*
+ * Copyright © 2025-2026 Apple Inc. and the Pkl project authors. All rights reserved.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+import com.diffplug.spotless.FormatterFunc
+import com.diffplug.spotless.FormatterStep
+import java.io.Serial
+import java.io.Serializable
+import java.net.URLClassLoader
+import org.gradle.api.artifacts.Configuration
+
+class PklFormatterStep(@Transient private val configuration: Configuration) : Serializable {
+  companion object {
+    @Serial private const val serialVersionUID: Long = 1L
+  }
+
+  fun create(): FormatterStep {
+    return FormatterStep.createLazy(
+      "pkl",
+      { PklFormatterStep(configuration) },
+      { PklFormatterFunc(configuration) },
+    )
+  }
+}
+
+class PklFormatterFunc(@Transient private val configuration: Configuration) :
+  FormatterFunc, Serializable {
+  companion object {
+    @Serial private const val serialVersionUID: Long = 1L
+  }
+
+  private val classLoader by lazy {
+    val urls = configuration.files.map { it.toURI().toURL() }
+    // Use the platform classloader as parent to isolate from Gradle's classloader
+    URLClassLoader(urls.toTypedArray(), ClassLoader.getPlatformClassLoader())
+  }
+
+  private val formatterClass by lazy { classLoader.loadClass("org.pkl.formatter.Formatter") }
+
+  private val formatMethod by lazy { formatterClass.getMethod("format", String::class.java) }
+
+  private val formatterInstance by lazy { formatterClass.getConstructor().newInstance() }
+
+  override fun apply(input: String): String {
+    return formatMethod(formatterInstance, input) as String
+  }
+}
@@ -0,0 +1,146 @@
+/*
+ * Copyright © 2024-2026 Apple Inc. and the Pkl project authors. All rights reserved.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+import java.nio.charset.StandardCharsets
+import java.util.Base64
+import org.gradle.api.Project
+import org.gradle.api.publish.PublishingExtension
+import org.gradle.api.publish.maven.MavenPublication
+import org.gradle.api.publish.maven.tasks.AbstractPublishToMaven
+import org.gradle.api.publish.maven.tasks.GenerateMavenPom
+import org.gradle.kotlin.dsl.*
+import org.gradle.plugins.signing.SigningExtension
+
+/** Configures common POM metadata (licenses, developers, SCM, etc.) for all Pkl publications. */
+fun Project.configurePklPomMetadata() {
+  extensions.configure<PublishingExtension> {
+    publications.withType<MavenPublication>().configureEach {
+      pom {
+        name.set(artifactId)
+        licenses {
+          license {
+            name.set("The Apache Software License, Version 2.0")
+            url.set("https://github.com/apple/pkl/blob/main/LICENSE.txt")
+          }
+        }
+        developers {
+          developer {
+            id.set("pkl-authors")
+            name.set("The Pkl Authors")
+            email.set("pkl-oss@group.apple.com")
+          }
+        }
+        scm {
+          connection.set("scm:git:git://github.com/apple/pkl.git")
+          developerConnection.set("scm:git:ssh://github.com/apple/pkl.git")
+          val buildInfo = extensions.getByType<BuildInfo>()
+          url.set("https://github.com/apple/pkl/tree/${buildInfo.commitish}")
+        }
+        issueManagement {
+          system.set("GitHub Issues")
+          url.set("https://github.com/apple/pkl/issues")
+        }
+        ciManagement {
+          system.set("GitHub Actions")
+          url.set("https://github.com/apple/pkl/actions")
+        }
+      }
+    }
+  }
+}
+
+/** Configures POM validation task to check for unresolved versions and snapshots in releases. */
+fun Project.configurePomValidation() {
+  val validatePom by tasks.registering {
+    if (tasks.findByName("generatePomFileForLibraryPublication") == null) {
+      return@registering
+    }
+    val generatePomFileForLibraryPublication by tasks.existing(GenerateMavenPom::class)
+    val outputFile =
+      layout.buildDirectory.file("validatePom") // dummy output to satisfy up-to-date check
+
+    dependsOn(generatePomFileForLibraryPublication)
+    inputs.file(generatePomFileForLibraryPublication.get().destination)
+    outputs.file(outputFile)
+
+    doLast {
+      outputFile.get().asFile.delete()
+
+      val pomFile = generatePomFileForLibraryPublication.get().destination
+      assert(pomFile.exists())
+
+      val text = pomFile.readText()
+
+      run {
+        val unresolvedVersion = Regex("<version>.*[+,()\\[\\]].*</version>")
+        val matches = unresolvedVersion.findAll(text).toList()
+        if (matches.isNotEmpty()) {
+          throw org.gradle.api.GradleException(
+            """
+        Found unresolved version selector(s) in generated POM:
+        ${matches.joinToString("\n") { it.groupValues[0] }}
+      """
+              .trimIndent()
+          )
+        }
+      }
+
+      val buildInfo = project.extensions.getByType<BuildInfo>()
+      if (buildInfo.isReleaseBuild) {
+        val snapshotVersion = Regex("<version>.*-SNAPSHOT</version>")
+        val matches = snapshotVersion.findAll(text).toList()
+        if (matches.isNotEmpty()) {
+          throw org.gradle.api.GradleException(
+            """
+        Found snapshot version(s) in generated POM of Pkl release version:
+        ${matches.joinToString("\n") { it.groupValues[0] }}
+      """
+              .trimIndent()
+          )
+        }
+      }
+
+      outputFile.get().asFile.writeText("OK")
+    }
+  }
+
+  tasks.named("publish") { dependsOn(validatePom) }
+}
+
+/** Configures signing for Pkl publications. */
+fun Project.configurePklSigning() {
+  // Workaround for maven publish plugin not setting up dependencies correctly.
+  // Taken from https://github.com/gradle/gradle/issues/26091#issuecomment-1798137734
+  val dependsOnTasks = mutableListOf<String>()
+
+  tasks.withType<AbstractPublishToMaven>().configureEach {
+    dependsOnTasks.add(name.replace("publish", "sign").replaceAfter("Publication", ""))
+    dependsOn(dependsOnTasks)
+  }
+
+  extensions.configure<SigningExtension> {
+    // provided as env vars `ORG_GRADLE_PROJECT_signingKey` and
+    // `ORG_GRADLE_PROJECT_signingPassword` in CI.
+    val signingKey =
+      (findProperty("signingKey") as String?)?.let {
+        Base64.getDecoder().decode(it).toString(StandardCharsets.US_ASCII)
+      }
+    val signingPassword = findProperty("signingPassword") as String?
+    if (signingKey != null && signingPassword != null) {
+      useInMemoryPgpKeys(signingKey, signingPassword)
+    }
+    extensions.getByType<PublishingExtension>().publications.findByName("library")?.let { sign(it) }
+  }
+}
@@ -0,0 +1,60 @@
+/*
+ * Copyright © 2024-2026 Apple Inc. and the Pkl project authors. All rights reserved.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+import org.gradle.api.DefaultTask
+import org.gradle.api.artifacts.Configuration
+import org.gradle.api.artifacts.result.ResolvedArtifactResult
+import org.gradle.api.artifacts.result.ResolvedDependencyResult
+import org.gradle.api.file.DirectoryProperty
+import org.gradle.api.provider.Property
+import org.gradle.api.tasks.InputFiles
+import org.gradle.api.tasks.OutputDirectory
+import org.gradle.api.tasks.TaskAction
+import org.gradle.jvm.JvmLibrary
+import org.gradle.kotlin.dsl.property
+import org.gradle.language.base.artifact.SourcesArtifact
+
+open class ResolveSourcesJars : DefaultTask() {
+  @get:InputFiles val configuration: Property<Configuration> = project.objects.property()
+
+  @get:OutputDirectory val outputDir: DirectoryProperty = project.objects.directoryProperty()
+
+  @TaskAction
+  @Suppress("UnstableApiUsage", "unused")
+  fun resolve() {
+    val componentIds =
+      configuration.get().incoming.resolutionResult.allDependencies.map {
+        (it as ResolvedDependencyResult).selected.id
+      }
+
+    val resolutionResult =
+      project.dependencies
+        .createArtifactResolutionQuery()
+        .forComponents(componentIds)
+        .withArtifacts(JvmLibrary::class.java, SourcesArtifact::class.java)
+        .execute()
+
+    val resolvedJars =
+      resolutionResult.resolvedComponents
+        .flatMap { it.getArtifacts(SourcesArtifact::class.java) }
+        .map { (it as ResolvedArtifactResult).file }
+
+    // copying to an output dir because I don't know how else to describe task outputs
+    project.sync {
+      from(resolvedJars)
+      into(outputDir)
+    }
+  }
+}
@@ -0,0 +1,77 @@
+/*
+ * Copyright © 2026 Apple Inc. and the Pkl project authors. All rights reserved.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+import com.diffplug.spotless.FormatterFunc
+import com.diffplug.spotless.FormatterStep
+import java.io.File
+import java.io.Serial
+import java.io.Serializable
+
+/**
+ * A Spotless [FormatterStep] that suppresses formatting changes where the only difference between
+ * the formatted output and the file's content in the upstream base ref is the license header year.
+ *
+ * Avoids an issue where, in the process of working on the codebase:
+ * 1. A file is modified.
+ * 2. Spotless formats the file, and also updates the copyright year.
+ * 3. The original modification is reverted.
+ * 4. Spotless formats the file again, but now the copyright year is the updated year.
+ */
+class RevertYearOnlyChangesStep(private val repoRoot: File, private val ratchetFrom: String) :
+  Serializable {
+  companion object {
+    @Serial private const val serialVersionUID: Long = 1L
+  }
+
+  fun create(): FormatterStep =
+    FormatterStep.createLazy(
+      "revertYearOnlyChanges",
+      { this },
+      { RevertYearOnlyChangesFunc(repoRoot, ratchetFrom) },
+    )
+}
+
+class RevertYearOnlyChangesFunc(private val repoRoot: File, private val ratchetFrom: String) :
+  FormatterFunc.NeedsFile, Serializable {
+  companion object {
+    @Serial private const val serialVersionUID: Long = 1L
+
+    // Matches "Copyright © 2024" or "Copyright © 2024-2025"
+    private val YEAR_REGEX = Regex("""(Copyright © )\d{4}(-\d{4})?""")
+  }
+
+  override fun applyWithFile(unix: String, file: File): String {
+    val relativePath = repoRoot.toPath().relativize(file.toPath()).toString()
+    val upstreamContent = gitShow(ratchetFrom, relativePath) ?: return unix
+    val normalizedRaw = YEAR_REGEX.replace(unix, "\$1YEAR")
+    val normalizedUpstream = YEAR_REGEX.replace(upstreamContent, "\$1YEAR")
+    return if (normalizedRaw == normalizedUpstream) {
+      // Only the year changed — return the upstream content
+      upstreamContent
+    } else {
+      unix
+    }
+  }
+
+  private fun gitShow(ref: String, path: String): String? {
+    val process =
+      ProcessBuilder("git", "show", "$ref:$path")
+        .directory(repoRoot)
+        .redirectErrorStream(true)
+        .start()
+    val output = process.inputStream.readBytes().toString(Charsets.UTF_8)
+    return if (process.waitFor() == 0) output.replace("\r\n", "\n") else null
+  }
+}
@@ -0,0 +1,161 @@
+/*
+ * Copyright © 2024-2026 Apple Inc. and the Pkl project authors. All rights reserved.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+import com.diffplug.gradle.spotless.KotlinGradleExtension
+import org.gradle.accessors.dm.LibrariesForLibs
+
+plugins { id("com.diffplug.spotless") }
+
+val buildInfo = extensions.create<BuildInfo>("buildInfo", project)
+
+dependencyLocking { lockAllConfigurations() }
+
+configurations {
+  val rejectedVersionSuffix = Regex("-alpha|-beta|-eap|-m|-rc|-snapshot", RegexOption.IGNORE_CASE)
+  configureEach {
+    resolutionStrategy {
+      componentSelection {
+        all {
+          if (rejectedVersionSuffix.containsMatchIn(candidate.version)) {
+            reject(
+              "Rejected dependency $candidate " +
+                "because it has a prelease version suffix matching `$rejectedVersionSuffix`."
+            )
+          }
+        }
+      }
+    }
+  }
+}
+
+tasks.withType<JavaCompile>().configureEach {
+  javaCompiler = buildInfo.javaCompiler
+  options.release = buildInfo.jvmTarget
+}
+
+plugins.withType(IdeaPlugin::class).configureEach {
+  val errorMessage =
+    "Use IntelliJ Gradle import instead of running the `idea` task. See README for more information."
+
+  tasks.named("idea") { doFirst { throw GradleException(errorMessage) } }
+  tasks.named("ideaModule") { doFirst { throw GradleException(errorMessage) } }
+  if (project == rootProject) {
+    tasks.named("ideaProject") { doFirst { throw GradleException(errorMessage) } }
+  }
+}
+
+plugins.withType(MavenPublishPlugin::class).configureEach {
+  configure<PublishingExtension> {
+    // CI builds pick up artifacts from this repo.
+    // It's important that this repo is only declared once per project.
+    repositories {
+      maven {
+        name = "projectLocal" // affects task names
+        url = rootDir.resolve("build/m2").toURI()
+      }
+    }
+    // use resolved/locked (e.g., `1.15`)
+    // instead of declared (e.g., `1.+`)
+    // dependency versions in generated POMs
+    publications {
+      withType(MavenPublication::class.java) {
+        versionMapping { allVariants { fromResolutionResult() } }
+      }
+    }
+  }
+}
+
+// settings.gradle.kts sets `--write-locks`
+// if Gradle command line contains this task name
+val updateDependencyLocks by tasks.registering {
+  doLast { configurations.filter { it.isCanBeResolved }.forEach { it.resolve() } }
+}
+
+val allDependencies by tasks.registering(DependencyReportTask::class)
+
+tasks.withType(Test::class).configureEach {
+  System.getProperty("testReportsDir")?.let { reportsDir ->
+    reports.junitXml.outputLocation.set(file(reportsDir).resolve(project.name).resolve(name))
+  }
+  debugOptions {
+    enabled = System.getProperty("jvmdebug")?.toBoolean() ?: false
+    host = "*"
+    port = 5005
+    suspend = true
+    server = true
+  }
+}
+
+tasks.withType(JavaExec::class).configureEach {
+  debugOptions {
+    enabled = System.getProperty("jvmdebug")?.toBoolean() ?: false
+    host = "*"
+    port = 5005
+    suspend = true
+    server = true
+  }
+}
+
+// Version Catalog library symbols.
+private val libs = the<LibrariesForLibs>()
+
+private val licenseHeaderFile by lazy {
+  rootProject.file("build-logic/src/main/resources/license-header.star-block.txt")
+}
+
+private fun KotlinGradleExtension.configureFormatter() {
+  ktfmt(libs.versions.ktfmt.get()).googleStyle()
+  licenseHeaderFile(licenseHeaderFile, "([a-zA-Z]|@file|//)")
+}
+
+val originalRemoteName = System.getenv("PKL_ORIGINAL_REMOTE_NAME") ?: "origin"
+// if we're running against a release branch (or a PR targeted at one), use that branch for
+// ratcheting
+// these env vars are set by GitHub actions:
+// https://docs.github.com/en/actions/reference/workflows-and-actions/variables#default-environment-variables
+val ratchetBranchName =
+  (System.getenv("GITHUB_BASE_REF") ?: System.getenv("GITHUB_REF_NAME"))?.let {
+    if (it.startsWith("release/")) it else null
+  } ?: "main"
+
+spotless {
+  ratchetFrom = "$originalRemoteName/$ratchetBranchName"
+
+  val revertYearOnlyChangesStep =
+    RevertYearOnlyChangesStep(rootProject.rootDir, ratchetFrom!!).create()
+
+  // When building root project, format build-logic files too.
+  // We need this because build-logic is not a subproject of the root project, so a top-level
+  // `spotlessApply` will not trigger `build-logic:spotlessApply`.
+  if (project.path == rootProject.path) {
+    kotlinGradle {
+      configureFormatter()
+      addStep(revertYearOnlyChangesStep)
+      target("*.kts", "build-logic/*.kts", "build-logic/src/*/kotlin/**/*.kts")
+    }
+    kotlin {
+      ktfmt(libs.versions.ktfmt.get()).googleStyle()
+      target("build-logic/src/*/kotlin/**/*.kt")
+      licenseHeaderFile(licenseHeaderFile)
+      addStep(revertYearOnlyChangesStep)
+    }
+  } else {
+    kotlinGradle {
+      configureFormatter()
+      addStep(revertYearOnlyChangesStep)
+      target("*.kts")
+    }
+  }
+}
@@ -0,0 +1,222 @@
+/*
+ * Copyright © 2024-2026 Apple Inc. and the Pkl project authors. All rights reserved.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+import org.gradle.api.GradleException
+import org.gradle.api.artifacts.Configuration
+import org.gradle.api.publish.maven.MavenPublication
+import org.gradle.api.tasks.bundling.Jar
+import org.gradle.api.tasks.testing.Test
+import org.gradle.kotlin.dsl.*
+
+plugins {
+  `java-library`
+  `maven-publish`
+  id("com.gradleup.shadow")
+}
+
+// make fat Jar available to other subprojects
+val fatJarConfiguration: Configuration = configurations.create("fatJar")
+
+val fatJarPublication: MavenPublication = publishing.publications.create<MavenPublication>("fatJar")
+
+// ideally we'd configure this automatically based on project dependencies
+val firstPartySourcesJarsConfiguration: Configuration =
+  configurations.create("firstPartySourcesJars")
+
+val relocations =
+  mapOf(
+    // pkl-core dependencies
+    "org.organicdesign.fp." to "org.pkl.thirdparty.paguro.",
+    "org.snakeyaml.engine." to "org.pkl.thirdparty.snakeyaml.engine.",
+    "org.msgpack." to "org.pkl.thirdparty.msgpack.",
+    "org.w3c.dom." to "org.pkl.thirdparty.w3c.dom.",
+    "com.oracle.svm.core." to "org.pkl.thirdparty.svm.",
+
+    // pkl-cli dependencies
+    "org.jline." to "org.pkl.thirdparty.jline.",
+    "com.github.ajalt.clikt." to "org.pkl.thirdparty.clikt.",
+    "com.github.ajalt.colormath." to "org.pkl.thirdparty.colormath.",
+    "com.github.ajalt.mordant." to "org.pkl.thirdparty.mordant.",
+    "com.sun.jna." to "org.pkl.thirdparty.jna.",
+    "kotlin." to "org.pkl.thirdparty.kotlin.",
+    "kotlinx." to "org.pkl.thirdparty.kotlinx.",
+    "org.intellij." to "org.pkl.thirdparty.intellij.",
+    "org.fusesource.jansi." to "org.pkl.thirdparty.jansi.",
+    "org.fusesource.hawtjni." to "org.pkl.thirdparty.hawtjni.",
+
+    // pkl-doc dependencies
+    "org.commonmark." to "org.pkl.thirdparty.commonmark.",
+    "org.jetbrains." to "org.pkl.thirdparty.jetbrains.",
+    "_COROUTINE." to "org.pkl.thirdparty.kotlinx._COROUTINE.",
+
+    // pkl-config-java dependencies
+    "io.leangen.geantyref." to "org.pkl.thirdparty.geantyref.",
+
+    // pkl-codegen-java dependencies
+    "com.palantir.javapoet." to "org.pkl.thirdparty.javapoet.",
+
+    // pkl-codegen-kotlin dependencies
+    "com.squareup.kotlinpoet." to "org.pkl.thirdparty.kotlinpoet.",
+  )
+
+for ((key, value) in relocations) {
+  if (!key.endsWith(".")) {
+    throw GradleException(
+      "Invalid relocation `\"$key\" to \"$value\"`: `$key` should end with a dot"
+    )
+  }
+  if (!value.endsWith(".")) {
+    throw GradleException(
+      "Invalid relocation `\"$key\" to \"$value\"`: `$value` should end with a dot"
+    )
+  }
+}
+
+val nonRelocations = listOf("com/oracle/truffle/", "org/graalvm/", "org/jspecify")
+
+tasks.shadowJar {
+  inputs.property("relocations", relocations)
+
+  archiveClassifier.set(null as String?)
+
+  configurations = listOf(project.configurations.runtimeClasspath.get())
+
+  addMultiReleaseAttribute = true
+
+  // not required at runtime / fat JARs can't be used in native-image builds anyway
+  exclude("org/pkl/cli/svm/**")
+
+  exclude("META-INF/maven/**")
+  exclude("META-INF/upgrade/**")
+
+  exclude("DebugProbesKt.bin")
+
+  val info = project.extensions.getByType<BuildInfo>()
+  val minimumJvmTarget = JavaVersion.toVersion(info.jvmTarget)
+
+  manifest.attributes(
+    // Certain exports need to be added to the Java modulepath for Java 17 to work properly with
+    // shaded JARs. See the following link for an explanation of this syntax:
+    // https://bugs.openjdk.org/browse/JDK-8335225
+    "Add-Exports" to info.jpmsExportsForJarManifest
+  )
+
+  // effectively, this results in calls excluding:
+  // `META-INF/versions/{18-25}/**`
+  // at the time of this writing; multi-release JARs beyond JDK 21 break the current
+  // version of the Shadow plugin, and aren't needed for Truffle's use by Pkl.
+  JavaVersionRange.startingAt(JavaLanguageVersion.of(minimumJvmTarget.majorVersion.toInt() + 1))
+    .forEach { exclude("META-INF/versions/${it.asInt()}/**") }
+
+  exclude("module-info.*")
+
+  for ((from, to) in relocations) {
+    relocate(from, to)
+  }
+
+  // necessary for service files to be adapted to relocation
+  mergeServiceFiles()
+}
+
+shadow { addShadowVariantIntoJavaComponent = false }
+
+val testFatJar by
+  tasks.registering(Test::class) {
+    testClassesDirs = files(tasks.test.get().testClassesDirs)
+    classpath =
+      // compiled test classes
+      sourceSets.test.get().output +
+        // fat Jar
+        tasks.shadowJar.get().outputs.files +
+        // test-only dependencies
+        // (test dependencies that are also main dependencies must already be contained in fat Jar;
+        // to verify that, we don't want to include them here)
+        (configurations.testRuntimeClasspath.get() - configurations.runtimeClasspath.get())
+  }
+
+tasks.check { dependsOn(testFatJar) }
+
+val validateFatJar by tasks.registering {
+  val outputFile = layout.buildDirectory.file("validateFatJar/result.txt")
+  inputs.files(tasks.shadowJar)
+  inputs.property("nonRelocations", nonRelocations)
+  outputs.file(outputFile)
+
+  doLast {
+    val unshadowedFiles = mutableListOf<String>()
+    zipTree(tasks.shadowJar.get().outputs.files.singleFile).visit {
+      val fileDetails = this
+      val path = fileDetails.relativePath.pathString
+      if (
+        !(fileDetails.isDirectory ||
+          path.startsWith("org/pkl/") ||
+          path.startsWith("META-INF/") ||
+          nonRelocations.any { path.startsWith(it) })
+      ) {
+        // don't throw exception inside `visit`
+        // as this gives a misleading "Could not expand ZIP" error message
+        unshadowedFiles.add(path)
+      }
+    }
+    if (unshadowedFiles.isEmpty()) {
+      outputFile.get().asFile.writeText("SUCCESS")
+    } else {
+      outputFile.get().asFile.writeText("FAILURE")
+      throw GradleException("Found unshadowed files:\n" + unshadowedFiles.joinToString("\n"))
+    }
+  }
+}
+
+tasks.check { dependsOn(validateFatJar) }
+
+val resolveSourcesJars by
+  tasks.registering(ResolveSourcesJars::class) {
+    configuration.set(configurations.runtimeClasspath)
+    outputDir.set(layout.buildDirectory.dir("resolveSourcesJars"))
+  }
+
+val fatSourcesJar by
+  tasks.registering(MergeSourcesJars::class) {
+    plugins.withId("pklJavaLibrary") { inputJars.from(tasks.named("sourcesJar")) }
+    inputJars.from(firstPartySourcesJarsConfiguration)
+    inputJars.from(resolveSourcesJars.map { fileTree(it.outputDir) })
+
+    mergedBinaryJars.from(tasks.shadowJar)
+    relocatedPackages.set(relocations)
+    outputJar.fileProvider(
+      provider {
+        file(tasks.shadowJar.get().archiveFile.get().asFile.path.replace(".jar", "-sources.jar"))
+      }
+    )
+  }
+
+artifacts { add("fatJar", tasks.shadowJar) }
+
+publishing {
+  publications {
+    named<MavenPublication>("fatJar") {
+      from(components["shadow"])
+
+      // sources Jar is fat
+      artifact(fatSourcesJar.flatMap { it.outputJar.asFile }) { classifier = "sources" }
+
+      plugins.withId("pklJavaLibrary") {
+        val javadocJar by tasks.existing(Jar::class)
+        // Javadoc Jar is not fat (didn't invest effort)
+        artifact(javadocJar.flatMap { it.archiveFile }) { classifier = "javadoc" }
+      }
+    }
+  }
+}
@@ -0,0 +1,74 @@
+/*
+ * Copyright © 2024-2026 Apple Inc. and the Pkl project authors. All rights reserved.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+import de.undercouch.gradle.tasks.download.Download
+import de.undercouch.gradle.tasks.download.Verify
+
+plugins { id("de.undercouch.download") }
+
+val buildInfo = project.extensions.getByType<BuildInfo>()
+
+// tries to minimize chance of corruption by download-to-temp-file-and-move
+val downloadGraalVmAarch64 by
+  tasks.registering(Download::class) { configureDownloadGraalVm(buildInfo.graalVmAarch64) }
+
+val downloadGraalVmAmd64 by
+  tasks.registering(Download::class) { configureDownloadGraalVm(buildInfo.graalVmAmd64) }
+
+fun Download.configureDownloadGraalVm(graalvm: BuildInfo.GraalVm) {
+  onlyIf { !graalvm.installDir.exists() }
+  doLast { println("Downloaded GraalVm to ${graalvm.downloadFile}") }
+
+  src(graalvm.downloadUrl)
+  dest(graalvm.downloadFile)
+  overwrite(false)
+  tempAndMove(true)
+}
+
+val verifyGraalVmAarch64 by
+  tasks.registering(Verify::class) {
+    configureVerifyGraalVm(buildInfo.graalVmAarch64)
+    dependsOn(downloadGraalVmAarch64)
+  }
+
+val verifyGraalVmAmd64 by
+  tasks.registering(Verify::class) {
+    configureVerifyGraalVm(buildInfo.graalVmAmd64)
+    dependsOn(downloadGraalVmAmd64)
+  }
+
+fun Verify.configureVerifyGraalVm(graalvm: BuildInfo.GraalVm) {
+  onlyIf { !graalvm.installDir.exists() }
+
+  src(graalvm.downloadFile)
+  checksum(
+    buildInfo.libs.findVersion("graalVmSha256-${graalvm.osName}-${graalvm.arch}").get().toString()
+  )
+  algorithm("SHA-256")
+}
+
+@Suppress("unused")
+val installGraalVmAarch64 by
+  tasks.registering(InstallGraalVm::class) {
+    dependsOn(verifyGraalVmAarch64)
+    graalVm = buildInfo.graalVmAarch64
+  }
+
+@Suppress("unused")
+val installGraalVmAmd64 by
+  tasks.registering(InstallGraalVm::class) {
+    dependsOn(verifyGraalVmAmd64)
+    graalVm = buildInfo.graalVmAmd64
+  }
@@ -0,0 +1,113 @@
+/*
+ * Copyright © 2024-2026 Apple Inc. and the Pkl project authors. All rights reserved.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+plugins { java }
+
+val gradlePluginTests = extensions.create<GradlePluginTests>("gradlePluginTests")
+
+tasks.addRule("Pattern: compatibilityTest[All|Releases|Latest|Candidate|Nightly|<GradleVersion>]") {
+  val taskName = this
+  val matchResult = Regex("compatibilityTest(.+)").matchEntire(taskName) ?: return@addRule
+
+  // https://github.com/gradle/gradle/issues/32599
+  @Suppress("DEPRECATION")
+  when (val taskNameSuffix = matchResult.groupValues[1]) {
+    "All" ->
+      task("compatibilityTestAll") {
+        dependsOn(
+          "compatibilityTestReleases",
+          "compatibilityTestCandidate",
+          "compatibilityTestNightly",
+        )
+      }
+    // releases in configured range
+    "Releases" ->
+      task("compatibilityTestReleases") {
+        val versionInfos = GradleVersionInfo.fetchReleases()
+        val allVersions =
+          versionInfos
+            .filter { versionInfo ->
+              val v = versionInfo.gradleVersion
+              !versionInfo.broken &&
+                v in gradlePluginTests.minGradleVersion..gradlePluginTests.maxGradleVersion &&
+                v !in gradlePluginTests.skippedGradleVersions
+            }
+            .sortedBy { it.gradleVersion }
+        val versionsToTestAgainst = listOf(allVersions.first(), allVersions.last())
+
+        dependsOn(versionsToTestAgainst.map { createCompatibilityTestTask(it) })
+      }
+    // latest release (if not developing against latest)
+    "Latest" ->
+      task("compatibilityTestLatest") {
+        val versionInfo = GradleVersionInfo.fetchCurrent()
+        if (versionInfo.version == gradle.gradleVersion) {
+          doLast {
+            println(
+              "No new Gradle release available. " +
+                "(Run `gradlew test` to test against ${versionInfo.version}.)"
+            )
+          }
+        } else {
+          dependsOn(createCompatibilityTestTask(versionInfo))
+        }
+      }
+    // active release candidate (if any)
+    "Candidate" ->
+      task("compatibilityTestCandidate") {
+        val versionInfo = GradleVersionInfo.fetchRc()
+        if (versionInfo?.activeRc == true) {
+          dependsOn(createCompatibilityTestTask(versionInfo))
+        } else {
+          doLast { println("No active Gradle release candidate available.") }
+        }
+      }
+    // latest nightly
+    "Nightly" ->
+      task("compatibilityTestNightly") {
+        val versionInfo = GradleVersionInfo.fetchNightly()
+        dependsOn(createCompatibilityTestTask(versionInfo))
+      }
+    // explicit version
+    else ->
+      createCompatibilityTestTask(
+        taskNameSuffix,
+        "https://services.gradle.org/distributions-snapshots/gradle-$taskNameSuffix-bin.zip",
+      )
+  }
+}
+
+fun createCompatibilityTestTask(versionInfo: GradleVersionInfo): TaskProvider<Test> =
+  createCompatibilityTestTask(versionInfo.version, versionInfo.downloadUrl)
+
+fun createCompatibilityTestTask(version: String, downloadUrl: String): TaskProvider<Test> {
+  return tasks.register("compatibilityTest$version", Test::class.java) {
+    mustRunAfter(tasks.test)
+
+    maxHeapSize = tasks.test.get().maxHeapSize
+    jvmArgs = tasks.test.get().jvmArgs
+    classpath = tasks.test.get().classpath
+    systemProperty("testGradleVersion", version)
+    systemProperty("testGradleDistributionUrl", downloadUrl)
+
+    doFirst {
+      if (version == gradle.gradleVersion && gradle.taskGraph.hasTask(tasks.test.get())) {
+        // don't test same version twice
+        println("This version has already been tested by the `test` task.")
+        throw StopExecutionException()
+      }
+    }
+  }
+}
@@ -0,0 +1,75 @@
+/*
+ * Copyright © 2024-2026 Apple Inc. and the Pkl project authors. All rights reserved.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+plugins { base }
+
+val htmlValidator = extensions.create<HtmlValidator>("htmlValidator", project)
+
+val buildInfo = project.extensions.getByType<BuildInfo>()
+
+val validatorConfiguration: Configuration =
+  configurations.create("validator") {
+    resolutionStrategy.eachDependency {
+      if (requested.group == "log4j" && requested.name == "log4j") {
+        useTarget(buildInfo.libs.findLibrary("log4j12Api").get())
+        because("mitigate critical security vulnerabilities")
+      }
+    }
+  }
+
+dependencies {
+  validatorConfiguration(buildInfo.libs.findLibrary("nuValidator").get()) {
+    // remove unnecessary dependencies
+    // (some of the requested versions don't even exist on Maven Central)
+    exclude(group = "org.eclipse.jetty", module = "jetty-alpn-client")
+    exclude(group = "org.eclipse.jetty", module = "jetty-continuation")
+    exclude(group = "org.eclipse.jetty", module = "jetty-http")
+    exclude(group = "org.eclipse.jetty", module = "jetty-security")
+    exclude(group = "org.eclipse.jetty", module = "jetty-server")
+    exclude(group = "org.eclipse.jetty", module = "jetty-servlets")
+    exclude(group = "org.eclipse.jetty", module = "jetty-jakarta-servlet-api")
+    exclude(group = "org.eclipse.jetty.toolchain")
+    exclude(group = "javax.servlet")
+    exclude(group = "org.apache.commons", module = "commons-fileupload2-core")
+    exclude(group = "org.apache.commons", module = "commons-fileupload2-jakarta-servlet5")
+  }
+}
+
+val validateHtml by
+  tasks.registering(JavaExec::class) {
+    val resultFile = layout.buildDirectory.file("validateHtml/result.txt")
+    inputs.files(htmlValidator.sources)
+    outputs.file(resultFile)
+
+    classpath = validatorConfiguration
+    mainClass.set("nu.validator.client.SimpleCommandLineValidator")
+    args(
+      "--skip-non-html"
+    ) // --also-check-css doesn't work (still checks css as html), so limit to html files
+    args("--filterpattern", "(.*)Consider adding “lang=(.*)")
+    args("--filterpattern", "(.*)Consider adding a “lang” attribute(.*)")
+    args("--filterpattern", "(.*)unrecognized media “amzn-kf8”(.*)") // kindle
+    // for debugging
+    // args "--verbose"
+    args(htmlValidator.sources)
+
+    // write a basic result file s.t. gradle can consider task up-to-date
+    // writing a result file in case validation fails is not easily possible with JavaExec, but also
+    // not strictly necessary
+    doFirst { project.delete(resultFile) }
+    doLast { resultFile.get().asFile.writeText("Success.") }
+  }
+
+tasks.check { dependsOn(validateHtml) }
@@ -0,0 +1,46 @@
+/*
+ * Copyright © 2025-2026 Apple Inc. and the Pkl project authors. All rights reserved.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+import net.ltgt.gradle.errorprone.errorprone
+import net.ltgt.gradle.nullaway.nullaway
+import org.gradle.accessors.dm.LibrariesForLibs
+import org.gradle.api.tasks.compile.JavaCompile
+
+plugins {
+  `java-library`
+  id("net.ltgt.errorprone")
+  id("net.ltgt.nullaway")
+}
+
+val libs = the<LibrariesForLibs>()
+
+dependencies {
+  api(libs.jspecify)
+  errorprone(libs.errorProne)
+  errorprone(libs.nullaway)
+}
+
+nullaway { onlyNullMarked = true }
+
+tasks.withType<JavaCompile>().configureEach {
+  options.errorprone.disableAllChecks = true
+  options.errorprone.nullaway {
+    error()
+    onlyNullMarked = true
+    jspecifyMode = true
+    // honor assert x != null in addition to Objects.requireNonNull(x)
+    assertsEnabled = true
+  }
+}
@@ -0,0 +1,130 @@
+/*
+ * Copyright © 2025-2026 Apple Inc. and the Pkl project authors. All rights reserved.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+import kotlin.io.path.createDirectories
+import kotlin.io.path.writeText
+import org.gradle.kotlin.dsl.support.serviceOf
+
+plugins {
+  id("pklJavaLibrary")
+  //  id("pklPublishLibrary")
+  id("com.gradleup.shadow")
+}
+
+val executableSpec = project.extensions.create("executable", ExecutableSpec::class.java)
+val buildInfo = project.extensions.getByType<BuildInfo>()
+
+val javaExecutable by
+  tasks.registering(ExecutableJar::class) {
+    group = "build"
+    dependsOn(tasks.jar)
+    inJar = tasks.shadowJar.flatMap { it.archiveFile }
+    val effectiveJavaName =
+      executableSpec.javaName.map { name -> if (buildInfo.os.isWindows) "$name.bat" else name }
+    outJar = layout.buildDirectory.dir("executable").flatMap { it.file(effectiveJavaName) }
+
+    // uncomment for debugging
+    // jvmArgs.addAll("-ea", "-agentlib:jdwp=transport=dt_socket,server=y,suspend=y,address=5005")
+  }
+
+fun Task.setupTestStartJavaExecutable(launcher: Provider<JavaLauncher>? = null) {
+  group = "verification"
+  dependsOn(javaExecutable)
+
+  // dummy output to satisfy up-to-date check
+  val outputFile = layout.buildDirectory.file("testStartJavaExecutable/$name")
+  outputs.file(outputFile)
+
+  val execOutput = providers.exec {
+    val executablePath = javaExecutable.get().outputs.files.singleFile
+    if (launcher?.isPresent == true) {
+      commandLine(
+        launcher.get().executablePath.asFile.absolutePath,
+        "-jar",
+        executablePath.absolutePath,
+        "--version",
+      )
+    } else {
+      commandLine(executablePath.absolutePath, "--version")
+    }
+  }
+
+  doLast {
+    val outputText = execOutput.standardOutput.asText.get()
+    if (!outputText.contains(buildInfo.pklVersionNonUnique)) {
+      throw GradleException(
+        "Expected version output to contain current version (${buildInfo.pklVersionNonUnique}), but got '$outputText'"
+      )
+    }
+    outputFile.get().asFile.toPath().apply {
+      try {
+        parent.createDirectories()
+      } catch (_: java.nio.file.FileAlreadyExistsException) {}
+      writeText("OK")
+    }
+  }
+}
+
+val testStartJavaExecutable by tasks.registering { setupTestStartJavaExecutable() }
+
+// Setup `testStartJavaExecutable` tasks for multi-JDK testing.
+val testStartJavaExecutableOnOtherJdks =
+  buildInfo.jdkTestRange.map { jdkTarget ->
+    tasks.register("testStartJavaExecutableJdk${jdkTarget.asInt()}") {
+      enabled = buildInfo.isVersionEnabled(jdkTarget)
+      val toolChainService: JavaToolchainService = serviceOf()
+      val launcher = toolChainService.launcherFor { languageVersion = jdkTarget }
+      setupTestStartJavaExecutable(launcher)
+    }
+  }
+
+tasks.assemble { dependsOn(javaExecutable) }
+
+tasks.check {
+  dependsOn(testStartJavaExecutable)
+  dependsOn(testStartJavaExecutableOnOtherJdks)
+}
+
+// publishing {
+//  publications {
+//    // need to put in `afterEvaluate` because `artifactId` cannot be set lazily.
+//    project.afterEvaluate {
+//      register<MavenPublication>("javaExecutable") {
+//        artifactId = executableSpec.javaPublicationName.get()
+//
+//        artifact(javaExecutable.map { it.outputs.files.singleFile }) {
+//          classifier = null
+//          extension = "bin"
+//          builtBy(javaExecutable)
+//        }
+//
+//        pom {
+//          url = executableSpec.website
+//          description =
+//            executableSpec.documentationName.map { name ->
+//              """
+//            $name executable for Java.
+//            Can be executed directly, or with `java -jar <path/to/jpkl>`.
+//            Requires Java 17 or higher.
+//            """
+//                .trimIndent()
+//            }
+//        }
+//      }
+//    }
+//  }
+// }
+
+// signing { project.afterEvaluate { sign(publishing.publications["javaExecutable"]) } }
@@ -0,0 +1,123 @@
+/*
+ * Copyright © 2024-2026 Apple Inc. and the Pkl project authors. All rights reserved.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+@file:Suppress("HttpUrlsUsage", "unused")
+
+import org.gradle.accessors.dm.LibrariesForLibs
+
+plugins {
+  `java-library`
+  `jvm-toolchains`
+  `jvm-test-suite`
+  id("pklKotlinTest")
+  id("com.diffplug.spotless")
+}
+
+// make sources Jar available to other subprojects
+val sourcesJarConfiguration: Provider<Configuration> = configurations.register("sourcesJar")
+
+// Version Catalog library symbols.
+val libs = the<LibrariesForLibs>()
+
+// Build configuration.
+val info = project.extensions.getByType<BuildInfo>()
+
+java {
+  withSourcesJar() // creates `sourcesJar` task
+  withJavadocJar()
+
+  toolchain {
+    languageVersion = info.jdkToolchainVersion
+    vendor = info.jdkVendor
+  }
+}
+
+artifacts {
+  // make sources Jar available to other subprojects
+  add("sourcesJar", tasks["sourcesJar"])
+}
+
+spotless {
+  val revertYearOnlyChanges = RevertYearOnlyChangesStep(rootProject.rootDir, ratchetFrom!!).create()
+
+  java {
+    addStep(revertYearOnlyChanges)
+    googleJavaFormat(libs.versions.googleJavaFormat.get())
+    target("src/*/java/**/*.java")
+    licenseHeaderFile(
+      rootProject.file("build-logic/src/main/resources/license-header.star-block.txt")
+    )
+  }
+}
+
+tasks.jar {
+  manifest {
+    attributes +=
+      mapOf(
+        "Automatic-Module-Name" to "org.${project.name.replace("-", ".")}",
+        "Add-Exports" to info.jpmsExportsForJarManifest,
+      )
+  }
+}
+
+tasks.javadoc {
+  classpath = sourceSets.main.get().output + sourceSets.main.get().compileClasspath
+  source = sourceSets.main.get().allJava
+  title = "${project.name} ${project.version} API"
+  (options as StandardJavadocDocletOptions).addStringOption("Xdoclint:none", "-quiet")
+}
+
+val truffleJavacArgs =
+  listOf(
+    // TODO: determine correct limits for Truffle specializations
+    // (see https://graalvm.slack.com/archives/CNQSB2DHD/p1712380902746829)
+    "-Atruffle.dsl.SuppressWarnings=truffle-limit"
+  )
+
+tasks.compileJava {
+  javaCompiler = info.javaCompiler
+  options.compilerArgs.addAll(truffleJavacArgs + info.jpmsAddModulesFlags)
+}
+
+tasks.withType<JavaCompile>().configureEach {
+  javaCompiler = info.javaCompiler
+  options.release = info.jvmTarget
+}
+
+tasks.withType<JavaExec>().configureEach { jvmArgs(info.jpmsAddModulesFlags) }
+
+fun Test.configureJdkTestTask(launcher: Provider<JavaLauncher>) {
+  useJUnitPlatform()
+  javaLauncher = launcher
+  systemProperties.putAll(info.testProperties)
+  jvmArgs.addAll(info.jpmsAddModulesFlags)
+}
+
+tasks.test { configureJdkTestTask(info.javaTestLauncher) }
+
+// Prepare test tasks for each JDK version which is within the test target suite for Pkl. Each task
+// uses a pinned JDK toolchain version, and is named for the major version which is tested.
+//
+// Test tasks configured in this manner are executed manually by name, e.g. `./gradlew testJdk11`,
+// and automatically as dependencies of `check`.
+//
+// We omit the current JDK from this list because it is already tested, in effect, by the default
+// `test` task.
+//
+// Pkl subprojects may elect to further configure these tasks as needed; by default, each task
+// inherits the configuration of the default `test` task (aside from an overridden launcher).
+val jdkTestTasks = info.multiJdkTestingWith(tasks.test) { (_, jdk) -> configureJdkTestTask(jdk) }
+
+tasks.check { dependsOn(jdkTestTasks) }
@@ -0,0 +1,115 @@
+/*
+ * Copyright © 2026 Apple Inc. and the Pkl project authors. All rights reserved.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+import org.gradle.accessors.dm.LibrariesForLibs
+import org.gradle.api.GradleException
+import org.gradle.kotlin.dsl.getByType
+import org.gradle.kotlin.dsl.kotlin
+import org.gradle.kotlin.dsl.the
+import org.jetbrains.kotlin.gradle.dsl.JvmTarget
+import org.jetbrains.kotlin.gradle.dsl.KotlinVersion
+
+plugins {
+  java
+  kotlin("jvm")
+  id("com.diffplug.spotless")
+}
+
+val buildInfo = project.extensions.getByType<BuildInfo>()
+
+val libs = the<LibrariesForLibs>()
+
+kotlin {
+  jvmToolchain {
+    languageVersion.set(buildInfo.jdkToolchainVersion)
+    vendor.set(buildInfo.jdkVendor)
+  }
+  compilerOptions {
+    val kotlinTarget = KotlinVersion.fromVersion(libs.versions.kotlinTarget.get())
+    languageVersion.set(kotlinTarget)
+    apiVersion.set(kotlinTarget)
+    jvmTarget = JvmTarget.fromTarget(buildInfo.jvmTarget.toString())
+    freeCompilerArgs.addAll(
+      "-jvm-default=no-compatibility", // was: -Xjvm-default=all
+      "-Xjdk-release=${buildInfo.jvmTarget}",
+      "-Xjsr305=strict",
+    )
+  }
+}
+
+spotless {
+  val revertYearOnlyChanges = RevertYearOnlyChangesStep(rootProject.rootDir, ratchetFrom!!).create()
+
+  kotlin {
+    addStep(revertYearOnlyChanges)
+    ktfmt(libs.versions.ktfmt.get()).googleStyle()
+    target("src/*/kotlin/**/*.kt")
+    licenseHeaderFile(
+      rootProject.file("build-logic/src/main/resources/license-header.star-block.txt")
+    )
+  }
+}
+
+/**
+ * Kotlin modules to guard: fail the build if any dependency resolves to a version higher than
+ * `libs.versions.kotlinTarget`. This includes versions introduced via direct declarations, BOMs,
+ * version catalogs, or constraints.
+ */
+val guardedKotlinModules = setOf(libs.kotlinStdLib.get().module, libs.kotlinReflect.get().module)
+
+/**
+ * Classpath configurations where the above rule applies. Kept narrow to avoid interfering with
+ * Gradle/Kotlin plugin internal configurations.
+ */
+val guardedConfigurations =
+  setOf(
+    configurations.compileClasspath,
+    configurations.runtimeClasspath,
+    configurations.testCompileClasspath,
+    configurations.testRuntimeClasspath,
+  )
+
+guardedConfigurations.forEach { configuration ->
+  configuration.configure {
+    incoming.afterResolve {
+      resolutionResult.allComponents.forEach { component ->
+        val moduleVersion = component.moduleVersion ?: return@forEach
+        if (
+          moduleVersion.module in guardedKotlinModules &&
+            moduleVersion.version.exceedsKotlinTarget()
+        ) {
+          throw GradleException(
+            "Resolved ${moduleVersion.module}:${moduleVersion.version} on configuration $name, " +
+              "which exceeds the allowed Kotlin version ($kotlinTargetVersion)"
+          )
+        }
+      }
+    }
+  }
+}
+
+// also works for version ranges like: [2.3.0,)
+val kotlinVersionRegex = Regex("""(\d+)\.(\d+)(?:\.\d+)?""")
+val kotlinTargetVersion = libs.versions.kotlinTarget.get()
+val targetMajor = kotlinTargetVersion.substringBefore('.').toInt()
+val targetMinor = kotlinTargetVersion.substringAfter('.').toInt()
+
+fun String.exceedsKotlinTarget(): Boolean {
+  val version =
+    kotlinVersionRegex.find(this) ?: throw GradleException("Could not parse Kotlin version: $this")
+  val major = version.groupValues[1].toInt()
+  val minor = version.groupValues[2].toInt()
+  return major > targetMajor || (major == targetMajor && minor > targetMinor)
+}
@@ -0,0 +1,29 @@
+/*
+ * Copyright © 2024-2026 Apple Inc. and the Pkl project authors. All rights reserved.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+import org.gradle.accessors.dm.LibrariesForLibs
+
+plugins { id("pklJavaLibrary") }
+
+val buildInfo = project.extensions.getByType<BuildInfo>()
+
+val libs = the<LibrariesForLibs>()
+
+dependencies {
+  // Kotlin libraries typically expose stdlib types in their public APIs.
+  // Therefore, the stdlib must be available on the consumer's compile classpath,
+  // and "implementation" is not sufficient.
+  api(libs.kotlinStdLib)
+}
@@ -0,0 +1,80 @@
+/*
+ * Copyright © 2024-2026 Apple Inc. and the Pkl project authors. All rights reserved.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+import java.net.URI
+import org.gradle.accessors.dm.LibrariesForLibs
+import org.gradle.api.tasks.testing.logging.TestExceptionFormat
+
+plugins {
+  `jvm-test-suite`
+  id("pklKotlinBase")
+}
+
+val buildInfo = project.extensions.getByType<BuildInfo>()
+
+val libs = the<LibrariesForLibs>()
+
+dependencies {
+  testImplementation(libs.kotlinStdLib)
+
+  testImplementation(libs.assertj)
+  testImplementation(libs.junitApi)
+  testImplementation(libs.junitParams)
+
+  testRuntimeOnly(libs.junitEngine)
+  testRuntimeOnly(libs.junitLauncher)
+}
+
+tasks.withType<Test>().configureEach {
+  val testTask = this
+
+  useJUnitPlatform()
+
+  // enable checking of stdlib return types
+  systemProperty("org.pkl.testMode", "true")
+
+  reports.named("html") { required = true }
+
+  testLogging { exceptionFormat = TestExceptionFormat.FULL }
+
+  addTestListener(
+    object : TestListener {
+      override fun beforeSuite(suite: TestDescriptor) {}
+
+      override fun beforeTest(testDescriptor: TestDescriptor) {}
+
+      override fun afterTest(testDescriptor: TestDescriptor, result: TestResult) {}
+
+      // print report link at end of task, not just at end of build
+      override fun afterSuite(descriptor: TestDescriptor, result: TestResult) {
+        if (descriptor.parent != null) return // only interested in overall result
+
+        if (result.resultType == TestResult.ResultType.FAILURE) {
+          println(
+            "\nThere were failing tests. See the report at: ${fixFileUri(testTask.reports.html.entryPoint.toURI())}"
+          )
+        }
+      }
+
+      // makes links clickable on macOS
+      private fun fixFileUri(uri: URI): URI {
+        if ("file" == uri.scheme && !uri.schemeSpecificPart.startsWith("//")) {
+          return URI.create("file://" + uri.schemeSpecificPart)
+        }
+        return uri
+      }
+    }
+  )
+}
@@ -0,0 +1,338 @@
+/*
+ * Copyright © 2025-2026 Apple Inc. and the Pkl project authors. All rights reserved.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+import java.lang.Runtime.Version
+import kotlin.io.path.createDirectories
+import kotlin.io.path.writeText
+import org.gradle.accessors.dm.LibrariesForLibs
+
+plugins {
+  id("pklGraalVm")
+  id("pklJavaLibrary")
+  id("pklNativeLifecycle")
+  id("pklPublishLibrary")
+  id("com.gradleup.shadow")
+}
+
+// assumes that `pklJavaExecutable` is also applied
+val executableSpec = project.extensions.getByType<ExecutableSpec>()
+val buildInfo = project.extensions.getByType<BuildInfo>()
+
+val stagedMacAmd64Executable: Configuration by configurations.creating
+val stagedMacAarch64Executable: Configuration by configurations.creating
+val stagedLinuxAmd64Executable: Configuration by configurations.creating
+val stagedLinuxAarch64Executable: Configuration by configurations.creating
+val stagedAlpineLinuxAmd64Executable: Configuration by configurations.creating
+val stagedWindowsAmd64Executable: Configuration by configurations.creating
+
+val nativeImageClasspath by configurations.creating {
+  extendsFrom(configurations.runtimeClasspath.get())
+  // Ensure native-image version uses GraalVM C SDKs instead of Java FFI or JNA
+  // (comes from artifact `mordant-jvm-graal-ffi`).
+  exclude("com.github.ajalt.mordant", "mordant-jvm-ffm")
+  exclude("com.github.ajalt.mordant", "mordant-jvm-ffm-jvm")
+  exclude("com.github.ajalt.mordant", "mordant-jvm-jna")
+  exclude("com.github.ajalt.mordant", "mordant-jvm-jna-jvm")
+}
+
+val libs = the<LibrariesForLibs>()
+
+dependencies {
+  fun executableFile(suffix: String) =
+    files(
+      layout.buildDirectory.dir("executable").map { dir ->
+        dir.file(executableSpec.name.map { "$it-$suffix" })
+      }
+    )
+  nativeImageClasspath(libs.truffleRuntime)
+  nativeImageClasspath(libs.graalSdk)
+
+  stagedMacAarch64Executable(executableFile("macos-aarch64"))
+  stagedMacAmd64Executable(executableFile("macos-amd64"))
+  stagedLinuxAmd64Executable(executableFile("linux-amd64"))
+  stagedLinuxAarch64Executable(executableFile("linux-aarch64"))
+  stagedAlpineLinuxAmd64Executable(executableFile("alpine-linux-amd64"))
+  stagedWindowsAmd64Executable(executableFile("windows-amd64.exe"))
+}
+
+private fun NativeImageBuild.amd64() {
+  arch = Architecture.AMD64
+  dependsOn(":installGraalVmAmd64")
+}
+
+private fun NativeImageBuild.aarch64() {
+  arch = Architecture.AARCH64
+  dependsOn(":installGraalVmAarch64")
+}
+
+private fun NativeImageBuild.setClasspath() {
+  classpath.from(sourceSets.main.map { it.output })
+  classpath.from(
+    project(":pkl-commons-cli").extensions.getByType(SourceSetContainer::class)["svm"].output
+  )
+  classpath.from(nativeImageClasspath)
+}
+
+val macExecutableAmd64 by
+  tasks.registering(NativeImageBuild::class) {
+    imageName = executableSpec.name.map { "$it-macos-amd64" }
+    mainClass = executableSpec.mainClass
+    amd64()
+    setClasspath()
+  }
+
+val macExecutableAarch64 by
+  tasks.registering(NativeImageBuild::class) {
+    imageName = executableSpec.name.map { "$it-macos-aarch64" }
+    mainClass = executableSpec.mainClass
+    aarch64()
+    setClasspath()
+  }
+
+val linuxExecutableAmd64 by
+  tasks.registering(NativeImageBuild::class) {
+    imageName = executableSpec.name.map { "$it-linux-amd64" }
+    mainClass = executableSpec.mainClass
+    amd64()
+    setClasspath()
+  }
+
+val linuxExecutableAarch64 by
+  tasks.registering(NativeImageBuild::class) {
+    imageName = executableSpec.name.map { "$it-linux-aarch64" }
+    mainClass = executableSpec.mainClass
+    aarch64()
+    setClasspath()
+    // Ensure compatibility for kernels with page size set to 4k, 16k and 64k
+    // (e.g. Raspberry Pi 5, Asahi Linux)
+    extraNativeImageArgs.add("-H:PageSize=65536")
+  }
+
+val alpineExecutableAmd64 by
+  tasks.registering(NativeImageBuild::class) {
+    imageName = executableSpec.name.map { "$it-alpine-linux-amd64" }
+    mainClass = executableSpec.mainClass
+    amd64()
+    setClasspath()
+    extraNativeImageArgs.addAll(listOf("--static", "--libc=musl"))
+  }
+
+val windowsExecutableAmd64 by
+  tasks.registering(NativeImageBuild::class) {
+    imageName = executableSpec.name.map { "$it-windows-amd64" }
+    mainClass = executableSpec.mainClass
+    amd64()
+    setClasspath()
+  }
+
+val assembleNative by tasks.existing
+
+val testStartNativeExecutable by tasks.registering {
+  dependsOn(assembleNative)
+
+  // dummy file for up-to-date checking
+  val outputFile = project.layout.buildDirectory.file("testStartNativeExecutable/output.txt")
+  outputs.file(outputFile)
+
+  val execOutput = providers.exec {
+    commandLine(assembleNative.get().outputs.files.singleFile, "--version")
+  }
+
+  doLast {
+    val outputText = execOutput.standardOutput.asText.get()
+    if (!outputText.contains(buildInfo.pklVersionNonUnique)) {
+      throw GradleException(
+        "Expected version output to contain current version (${buildInfo.pklVersionNonUnique}), but got '$outputText'"
+      )
+    }
+    outputFile.get().asFile.toPath().apply {
+      try {
+        parent.createDirectories()
+      } catch (_: java.nio.file.FileAlreadyExistsException) {}
+      writeText("OK")
+    }
+  }
+}
+
+val requiredGlibcVersion: Version = Version.parse("2.17")
+
+val checkGlibc by tasks.registering {
+  enabled = buildInfo.os.isLinux && !buildInfo.musl
+  dependsOn(assembleNative)
+  doLast {
+    val exec = providers.exec {
+      commandLine("objdump", "-T", assembleNative.get().outputs.files.singleFile)
+    }
+    val output = exec.standardOutput.asText.get()
+    val minimumGlibcVersion =
+      output
+        .split("\n")
+        .mapNotNull { line ->
+          val match = Regex("GLIBC_([.0-9]*)").find(line)
+          match?.groups[1]?.let { Version.parse(it.value) }
+        }
+        .maxOrNull()
+    if (minimumGlibcVersion == null) {
+      throw GradleException(
+        "Could not determine glibc version from executable. objdump output: $output"
+      )
+    }
+    if (minimumGlibcVersion > requiredGlibcVersion) {
+      throw GradleException(
+        "Incorrect glibc version. Found: $minimumGlibcVersion, required: $requiredGlibcVersion"
+      )
+    }
+  }
+}
+
+// Expose underlying task's outputs
+private fun <T : Task> Task.wraps(other: TaskProvider<T>) {
+  dependsOn(other)
+  outputs.files(other)
+}
+
+val testNative by tasks.existing { dependsOn(testStartNativeExecutable, checkGlibc) }
+
+val assembleNativeMacOsAarch64 by tasks.existing { wraps(macExecutableAarch64) }
+
+val assembleNativeMacOsAmd64 by tasks.existing { wraps(macExecutableAmd64) }
+
+val assembleNativeLinuxAarch64 by tasks.existing { wraps(linuxExecutableAarch64) }
+
+val assembleNativeLinuxAmd64 by tasks.existing { wraps(linuxExecutableAmd64) }
+
+val assembleNativeAlpineLinuxAmd64 by tasks.existing { wraps(alpineExecutableAmd64) }
+
+val assembleNativeWindowsAmd64 by tasks.existing { wraps(windowsExecutableAmd64) }
+
+publishing {
+  publications {
+    // need to put in `afterEvaluate` because `artifactId` cannot be set lazily.
+    project.afterEvaluate {
+      create<MavenPublication>("macExecutableAmd64") {
+        artifactId = "${executableSpec.publicationName.get()}-macos-amd64"
+        artifact(stagedMacAmd64Executable.singleFile) {
+          classifier = null
+          extension = "bin"
+          builtBy(stagedMacAmd64Executable)
+        }
+        pom {
+          name = "${executableSpec.publicationName.get()}-macos-amd64"
+          url = executableSpec.website
+          description =
+            executableSpec.documentationName.map { name ->
+              "Native $name executable for macOS/amd64."
+            }
+        }
+      }
+
+      create<MavenPublication>("macExecutableAarch64") {
+        artifactId = "${executableSpec.publicationName.get()}-macos-aarch64"
+        artifact(stagedMacAarch64Executable.singleFile) {
+          classifier = null
+          extension = "bin"
+          builtBy(stagedMacAarch64Executable)
+        }
+        pom {
+          name = "${executableSpec.publicationName.get()}-macos-aarch64"
+          url = executableSpec.website
+          description =
+            executableSpec.documentationName.map { name ->
+              "Native $name executable for macOS/aarch64."
+            }
+        }
+      }
+
+      create<MavenPublication>("linuxExecutableAmd64") {
+        artifactId = "${executableSpec.publicationName.get()}-linux-amd64"
+        artifact(stagedLinuxAmd64Executable.singleFile) {
+          classifier = null
+          extension = "bin"
+          builtBy(stagedLinuxAmd64Executable)
+        }
+        pom {
+          name = "${executableSpec.publicationName.get()}-linux-amd64"
+          url = executableSpec.website
+          description =
+            executableSpec.documentationName.map { name ->
+              "Native $name executable for linux/amd64."
+            }
+        }
+      }
+
+      create<MavenPublication>("linuxExecutableAarch64") {
+        artifactId = "${executableSpec.publicationName.get()}-linux-aarch64"
+        artifact(stagedLinuxAarch64Executable.singleFile) {
+          classifier = null
+          extension = "bin"
+          builtBy(stagedLinuxAarch64Executable)
+        }
+        pom {
+          name = "${executableSpec.publicationName.get()}-linux-aarch64"
+          url = executableSpec.website
+          description =
+            executableSpec.documentationName.map { name ->
+              "Native $name executable for linux/aarch64."
+            }
+        }
+      }
+
+      create<MavenPublication>("alpineLinuxExecutableAmd64") {
+        artifactId = "${executableSpec.publicationName.get()}-alpine-linux-amd64"
+        artifact(stagedAlpineLinuxAmd64Executable.singleFile) {
+          classifier = null
+          extension = "bin"
+          builtBy(stagedAlpineLinuxAmd64Executable)
+        }
+        pom {
+          name = "${executableSpec.publicationName.get()}-alpine-linux-amd64"
+          url = executableSpec.website
+          description =
+            executableSpec.documentationName.map { name ->
+              "Native $name executable for linux/amd64 and statically linked to musl."
+            }
+        }
+      }
+
+      create<MavenPublication>("windowsExecutableAmd64") {
+        artifactId = "${executableSpec.publicationName.get()}-windows-amd64"
+        artifact(stagedWindowsAmd64Executable.singleFile) {
+          classifier = null
+          extension = "exe"
+          builtBy(stagedWindowsAmd64Executable)
+        }
+        pom {
+          name = "${executableSpec.publicationName.get()}-windows-amd64"
+          url = executableSpec.website
+          description =
+            executableSpec.documentationName.map { name ->
+              "Native $name executable for windows/amd64."
+            }
+        }
+      }
+    }
+  }
+}
+
+signing {
+  project.afterEvaluate {
+    sign(publishing.publications["linuxExecutableAarch64"])
+    sign(publishing.publications["linuxExecutableAmd64"])
+    sign(publishing.publications["macExecutableAarch64"])
+    sign(publishing.publications["macExecutableAmd64"])
+    sign(publishing.publications["alpineLinuxExecutableAmd64"])
+    sign(publishing.publications["windowsExecutableAmd64"])
+  }
+}
@@ -0,0 +1,122 @@
+/*
+ * Copyright © 2024-2026 Apple Inc. and the Pkl project authors. All rights reserved.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+val assembleNativeMacOsAarch64 by tasks.registering { group = "build" }
+
+val assembleNativeMacOsAmd64 by tasks.registering { group = "build" }
+
+val assembleNativeLinuxAarch64 by tasks.registering { group = "build" }
+
+val assembleNativeLinuxAmd64 by tasks.registering { group = "build" }
+
+val assembleNativeAlpineLinuxAmd64 by tasks.registering { group = "build" }
+
+val assembleNativeWindowsAmd64 by tasks.registering { group = "build" }
+
+val testNativeMacOsAarch64 by tasks.registering { group = "verification" }
+
+val testNativeMacOsAmd64 by tasks.registering { group = "verification" }
+
+val testNativeLinuxAarch64 by tasks.registering { group = "verification" }
+
+val testNativeLinuxAmd64 by tasks.registering { group = "verification" }
+
+val testNativeAlpineLinuxAmd64 by tasks.registering { group = "verification" }
+
+val testNativeWindowsAmd64 by tasks.registering { group = "verification" }
+
+val buildInfo = project.extensions.getByType<BuildInfo>()
+
+private fun <T : Task> Task.wraps(other: TaskProvider<T>) {
+  dependsOn(other)
+  outputs.files(other)
+}
+
+val assembleNative by tasks.registering {
+  group = "build"
+
+  if (!buildInfo.isCrossArchSupported && buildInfo.isCrossArch) {
+    throw GradleException("Cross-arch builds are not supported on ${buildInfo.os.name}")
+  }
+
+  when {
+    buildInfo.os.isMacOsX && buildInfo.targetArch == "aarch64" -> {
+      wraps(assembleNativeMacOsAarch64)
+    }
+    buildInfo.os.isMacOsX && buildInfo.targetArch == "amd64" -> {
+      wraps(assembleNativeMacOsAmd64)
+    }
+    buildInfo.os.isLinux && buildInfo.targetArch == "aarch64" -> {
+      wraps(assembleNativeLinuxAarch64)
+    }
+    buildInfo.os.isLinux && buildInfo.targetArch == "amd64" -> {
+      if (buildInfo.musl) wraps(assembleNativeAlpineLinuxAmd64) else wraps(assembleNativeLinuxAmd64)
+    }
+    buildInfo.os.isWindows && buildInfo.targetArch == "amd64" -> {
+      wraps(assembleNativeWindowsAmd64)
+    }
+    else -> {
+      doLast {
+        throw GradleException(
+          "Cannot build targeting ${buildInfo.os.name}/${buildInfo.targetArch} with musl=${buildInfo.musl}"
+        )
+      }
+    }
+  }
+}
+
+val testNative by tasks.registering {
+  group = "verification"
+  dependsOn(assembleNative)
+
+  if (!buildInfo.isCrossArchSupported && buildInfo.isCrossArch) {
+    throw GradleException("Cross-arch builds are not supported on ${buildInfo.os.name}")
+  }
+
+  when {
+    buildInfo.os.isMacOsX && buildInfo.targetArch == "aarch64" -> {
+      dependsOn(testNativeMacOsAarch64)
+    }
+    buildInfo.os.isMacOsX && buildInfo.targetArch == "amd64" -> {
+      dependsOn(testNativeMacOsAmd64)
+    }
+    buildInfo.os.isLinux && buildInfo.targetArch == "aarch64" -> {
+      dependsOn(testNativeLinuxAarch64)
+    }
+    buildInfo.os.isLinux && buildInfo.targetArch == "amd64" -> {
+      if (buildInfo.musl) dependsOn(testNativeAlpineLinuxAmd64) else dependsOn(testNativeLinuxAmd64)
+    }
+    buildInfo.os.isWindows && buildInfo.targetArch == "amd64" -> {
+      dependsOn(testNativeWindowsAmd64)
+    }
+    else -> {
+      doLast {
+        throw GradleException(
+          "Cannot build targeting ${buildInfo.os.name}/${buildInfo.targetArch} with musl=${buildInfo.musl}"
+        )
+      }
+    }
+  }
+}
+
+val checkNative by tasks.registering {
+  group = "verification"
+  dependsOn(testNative)
+}
+
+val buildNative by tasks.registering {
+  group = "build"
+  dependsOn(checkNative)
+}
@@ -0,0 +1,38 @@
+/*
+ * Copyright © 2024-2026 Apple Inc. and the Pkl project authors. All rights reserved.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+plugins {
+  `maven-publish`
+  signing
+}
+
+publishing {
+  publications {
+    components.findByName("java")?.let { javaComponent ->
+      create<MavenPublication>("library") { from(javaComponent) }
+    }
+  }
+}
+
+configurePklPomMetadata()
+
+configurePomValidation()
+
+configurePklSigning()
+
+artifacts {
+  project.tasks.findByName("javadocJar")?.let { archives(it) }
+  project.tasks.findByName("sourcesJar")?.let { archives(it) }
+}
@@ -0,0 +1,39 @@
+/*
+ * Copyright © 2025-2026 Apple Inc. and the Pkl project authors. All rights reserved.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+plugins { id("com.diffplug.spotless") }
+
+val pklFormatter by configurations.creating
+
+dependencies { pklFormatter(rootProject.project("pkl-formatter")) }
+
+spotless {
+  format("pkl") {
+    target("**/*.pkl")
+    addStep(PklFormatterStep(pklFormatter).create())
+    licenseHeaderFile(
+      rootProject.file("build-logic/src/main/resources/license-header.line-comment.txt"),
+      "/// ",
+    )
+    // disable ratcheting for Pkl sources
+    // make any change to pkl-formatter reformat the stdlib
+    ratchetFrom = null
+  }
+}
+
+for (taskName in
+  listOf("spotlessPkl", "spotlessPklApply", "spotlessPklCheck", "spotlessPklDiagnose")) {
+  tasks.named(taskName) { dependsOn(":pkl-formatter:assemble") }
+}
@@ -0,0 +1,16 @@
+//===----------------------------------------------------------------------===//
+// Copyright © $YEAR Apple Inc. and the Pkl project authors. All rights reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     https://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+//===----------------------------------------------------------------------===//
+
@@ -0,0 +1,15 @@
+/*
+ * Copyright © $YEAR Apple Inc. and the Pkl project authors. All rights reserved.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */