grounds 0.0.8

CI mode and Linux release. Still experimental. Binaries for macOS (Apple Silicon, Intel) and Linux (x86_64, arm64, statically linked: any distribution, Alpine and NixOS included).

target=aarch64-apple-darwin   # x86_64-apple-darwin, x86_64-unknown-linux-musl, aarch64-unknown-linux-musl
curl -fsSL https://github.com/mihaidaniel34/grounds/releases/download/v0.0.8/grounds-0.0.8-$target.tar.gz | tar -xz
sudo mv grounds-0.0.8-$target/grounds /usr/local/bin/

Each archive has a .sha256. The macOS binaries are not notarized: after a browser download, xattr -d com.apple.quarantine grounds.

CI mode: grounds changed --base <ref>
Checks what a branch or pull request changed since it forked from <ref>, committed or not:

• findings on the changed lines only, so existing code adds no noise;
• places in unchanged files the change broke: calls to removed or renamed members, implementations of a changed interface, @Overrides of a changed supertype, injection points whose bean was deleted or became ambiguous. grounds analyzes the other files against both versions of the changed ones and keeps what is new (about 1 s on spring-petclinic-rest, 17 s on camunda's 15,700 files);
• a breaks-other-files finding on each changed line that broke something, listing the broken places, so the break shows in the diff even though the broken files are not part of it.

--format sarif (also for check) writes SARIF 2.1.0 with paths from the repository root, for GitHub code scanning or reviewdog (use -filter-mode=nofilter, or reviewdog drops the breaks in unchanged files). --exit-zero for jobs that only upload results. The README has a GitHub Actions example.

Tested on 107 pull-request-shaped changes over 8 corpus projects: no false reports. Not yet checked across files: a deleted class, a method made private, static imports, method references, and return types assigned to variables.

Linux
The static Linux binary, a native Nix build and the macOS binary report identical findings, fingerprints included, so baselines carry over between systems. The Nix flake now builds on Linux (its tests no longer depend on jars in the machine's Maven/Gradle caches).

Fixes

• A checkout under a folder named build, or a package named build, lost those sources: apollo's com.ctrip.framework.apollo.build.* was never analyzed.
• With the project in a subdirectory of the repository, the agent hooks treated every line of a changed file as changed.
• A class defined in several files now resolves to the same one regardless of load order.
• unimplemented-abstract-method quotes the missing methods in its message.