Fail the build on compiler warnings and check the release bundle in CI

[oryan-block]

Unblocks #809

Checklist

• Pull requests follows the contribution guide
• New or modified functionality is covered by tests

Description

A few mistakes only showed up after they were merged. Sonar flagged deprecated calls in #834, the Kotlin 2.4 update (#809) broke on a warning we've had for a while, 6f78f35 had to fix a graphql-java 26 only API we started using, and the Maven 3.10 bundle problem only showed up at release time. This makes mvn verify and the PR checks catch these instead.

Compiler warnings fail the build now (-Werror for kotlinc, failOnWarning for javac). javac also uses <release>11</release> instead of source/target.

To get there I fixed all 42 existing warnings (23 main, 19 test). Most are mechanical: Kotlin class literals instead of java.lang.Object/java.util.Map, a redundant cast, casts in tests. The ones worth a look:

• module-info now has requires static org.jspecify. graphql-java's @Nullable annotations weren't readable from our module, which Kotlin 2.3 warns about ("Type annotation class 'Nullable' of the inferred type is inaccessible", KT-80247) and 2.4 turns into an error. That's what breaks Update kotlin #809. This branch builds and passes with Kotlin 2.4.21 and coroutines 1.11.0, the versions in Update kotlin #809.
• introspectionEnabled(false) uses BlockedFields.newBlock().addPattern("__.*") instead of the deprecated NoIntrospectionGraphqlFieldVisibility, which is exactly what that class does internally. The replacement graphql-java suggests, Introspection.enabledJvmWide, is JVM-wide so it doesn't work for a per-schema option. Nothing tested this option so I added IntrospectionTest, which passes on master too.
• SchemaParserOptions.build() and defaultOptions() aren't marked @ExperimentalCoroutinesApi anymore. Nothing in them is experimental, and Kotlin callers had to opt in just to build options. Removing the marker doesn't break source or binary compatibility.
• The legacy directive builder keeps using the deprecated argument value methods, with a @Suppress (it already has a TODO to go away). Same for the safe call on environment.graphQLSchema, which graphql-java marks non-null but is null in hand-built environments like the ones in our tests.

Two new PR jobs:

• graphql-java-25 runs verify against graphql-java 25.1, the oldest version we support. It would've caught what 6f78f35 fixed.
• release-bundle builds the Central bundle the same way the release does (release profile, Maven 3.9.16, -SNAPSHOT dropped) but points the upload at an unreachable URL. Then it checks the zip only has the pom, jar, sources, javadoc and their checksums. So the maven-metadata-local.xml problem from Maven 3.10, a missing sources or javadoc jar, or a javadoc error (javadoc only runs in the release profile) fails the PR instead of the release. I ran the check locally against a good bundle, one with maven-metadata-local.xml added, one without the javadoc jar, and no bundle at all.

Neither is a required check yet. The build (...) job names didn't change so branch protection still matches. If these look fine we can make them required.

mvn verify passes on graphql-java 26.1 and 25.1.

Heads up for the open PRs: nothing conflicts, but once this is merged #842 has 2 warnings (Object::class.java and java.util.Map::class.java in SchemaClassScanner) and #843 has 12 (deprecated legacy directive calls in DirectiveTest). #838 is fine.

🤖 Generated with Claude Code

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud