[oryan-block]

Why

Agents working in graphql-java-tools keep repeating the same mistakes, and the repo should change so a change that looks right from one file is right for the whole repo. Return value unwrapping is one of those spots. A change to ReturnValueUnwrapper or the generic wrappers can pass every unit test and still hand graphql-java a CompletableFuture or an Optional for a return type nobody wrote a test for. The bounded check that catches this was a local skill you had to remember to run, which is how the Optional<DataFetcherResult<...>> bug got found after the fact.

Description

• new ReturnValueUnwrappingTest runs the check at its default bounds (3 containers deep, 2 non-default choices per value) in mvn verify, so every PR and CI job on 17, 21 and 25 runs it. That's 171,693 executions over 2,649 accepted return types
• Check.java and Fixtures.java live in src/test/resources/returnvalue/ and the test compiles them when it runs. The test classes run inside the graphql.java.tools module, which doesn't read java.compiler, so it calls javac through java.util.spi.ToolProvider from java.base. They load in their own class loader and the temp dir is deleted after the run
• the verify-return-value-unwrapping skill is committed and its check.sh now runs that test, with the same options (--depth, --budget, --show, --rejected) and exit codes. So there's one copy of the check
• known-findings.txt moved next to the check and is empty. A finding listed there still passes the build, and one that no longer fails makes it fail as STALE

Cost is about 15s per build on JDK 25 on my machine. On 17 it took 32s inside a full mvn verify, but the machine had a load average around 45 from other builds at the time, so I'd take that number with a grain of salt.

No release note, nothing changes for library users.

Checklist

• Pull requests follows the contribution guide

• New or modified functionality is covered by tests

• mise exec java@temurin-17.0.21+9 -- mvn -B -ntp clean verify passes, 441 tests, and the new test reports 171693 executions and PASS

• at 3f022b91 (the parent of the Optional<DataFetcherResult<...>> fix), with Later removed since withCompletionStageTransformer doesn't exist there yet, check.sh exits 1 with FAIL: 357 executions in 29 return types. All 29 are Optional<DataFetcherResult<...>>. Unchanged, the check doesn't compile there and check.sh exits 2 with MODEL ERROR

• a known finding that no longer fails makes check.sh exit 3 with STALE

[sonarqubecloud]

Quality Gate passed

Issues
10 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud