🟡 Changes recommended

The new ConfigPropertiesReport.java has confirmed correctness/compilation issues (record component access + text-block handling + merging behavior) that will produce a broken or inaccurate report.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

🟡 Changes recommended

The new tooling introduces correctness/build risks (Gradle Java compatibility configuration and regex constant-resolution ambiguity) that should be addressed before merging.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

            var name = expr.contains(".") ? expr.substring(expr.lastIndexOf('.') + 1) : expr;
            var constantValueMatcher =
                    Pattern.compile(Pattern.quote(name) + "\\s*=\\s*\"([^\"]*)\"").matcher(raw);
            if (constantValueMatcher.find()) {
                prefix = constantValueMatcher.group(1);

🔵 Needs a closer look

The new ConfigPropertiesReport.java currently won’t compile due to record component field access and should also align its main signature with the repo’s JBang script convention.

        var defaultCell = entry.defaultValue == null || entry.defaultValue.isEmpty()
                ? "-"
                : "`" + mdEscape(entry.defaultValue) + "`";
        var sourceCell =
                String.join(", ", entry.sources.stream().map(s -> "`" + s + "`").toList());

Rebased onto current main and reviewed. The tool works and the parsing is more careful than I
expected for a regex approach — the tricky cases in the PR description really do come out right
(nested ${outer:${inner:default}}, the SpEL-wrapped @Value, RateLimitProperties.PROPERTY_PREFIX,
MirrorConfig's annotation order). My findings are about completeness of the output rather than
correctness of the parsing.

Rebase

main had moved to 08ad497a3 (#2176), which already added //JAVA 25+ to the four scripts this PR
also touched — that was the conflict. Resolved as:

• DependencyOverrideCheck.java — kept your maven-artifact bump to 3.9.16, with main's
  //JAVA-before-//DEPS ordering.
• ImportSort.java — kept main's spotless-lib:4.10.2. Your side had 3.3.1, which predates #2176
  moving it; restoring it would both undo that fix and fail the new formatter-version-check.sh.

The //JAVA 25+ churn on AddBracesFix/ClosingBraceFix/ImportSort is now redundant and dropped
out, so the diff went from 7 files to 4. MERGEABLE again. Force-pushed with --force-with-lease,
so nothing of yours could have been clobbered.

Verified on the rebased tree: spotlessCheck, formatter-version-check.sh, :buildSrc:compileJava,
and dependency-override-check.sh (confirming maven-artifact 3.9.16 works for its one consumer) all
pass, and the report itself runs and produces 206 keys.

Copilot's findings

Four of the six are already fixed on the branch: blankTextBlocks exists and runs first, source
locations are root.relativize(path), addEntry merges defaults/notes explicitly, and buildSrc uses
JavaVersion.VERSION_25.

One is simply wrong — the claim that field-style access on PropertyEntry "will not compile".
PropertyEntry is declared inside the implicit class, so its private components are accessible from
the enclosing class body. It compiles and runs. Worth not "fixing" on Copilot's say-so; the only real
point there is that the file mixes entry.key with entry.note(), which is a style inconsistency.

One is still open and correct: the constant lookup at both call sites has no identifier
boundaries, so Pattern.quote(name) + "\\s*=\\s*\"...\"" matches FOO inside MY_FOO. I checked
whether it currently misfires — adding \b on both sides produces byte-identical output, so it is
latent rather than active. Cheap to fix while it's cheap.

Findings of my own

1. @ConditionalOnProperty isn't scanned, and four real properties are missing as a result.
This is the one I'd want fixed. These keys are read only from @ConditionalOnProperty — no @Value
anywhere — so they appear nowhere in the reference:

The first three are operator-facing switches that gate whole subsystems, which makes them among the
most important things such a document should list. @ConditionalOnProperty also supports
prefix = <constant> (RateLimitConfig uses RateLimitProperties.PROPERTY_PREFIX), so the
constant-resolution machinery already in the script is what's needed. The PR description lists what's
out of scope and this isn't in it, so I assume it was an oversight rather than a decision.

2. Keys that exist only as a nested fallback default are dropped. AccessTokenConfig has:

@Value("#{'${ovsx.access-token.prefix:${ovsx.token-prefix:}}'}")

The report lists ovsx.access-token.prefix with default `${ovsx.token-prefix:}` but never lists
ovsx.token-prefix itself. That's the deprecated-key-fallback pattern AGENTS.md mandates for any
property that has shipped, so it's a recurring shape, and it's precisely the key an operator with the
old configuration needs to look up. PLACEHOLDER already captures the nested group; only the outer
match is used. (The other nested case, ovsx.trusted-publishing.audience:${ovsx.webui.url:}, is
covered only by luck — ovsx.webui.url has its own @Value elsewhere.)

3. @ConfigurationProperties field defaults are parsed and then thrown away. Around 30 of the 206
keys show - in the Default column while the source has a plain literal initializer. ovsx.rate-limit
is all eight of its keys:

private Boolean enabled = false;
private String tokenPrefix = "";
private String ipAddressFunction = "getRemoteAddr()";
private String defaultHttpContentType = "application/json";

addField computes declaration.split("=", 2)[0] and discards the right-hand side. Passing a simple
literal through (and leaving expressions like List.of("svg") or ExtensionProcessor.DEFAULT_MAX_TAGS
as -, or resolving the latter with the constant lookup that already exists) would fill in the column
that makes the document useful. Not a bug, but the biggest cheap win available.

4. trimmed.contains("static") is a substring test. Same class of issue as the word boundaries: a
field like String staticPath would be silently skipped as though it were a static member. No such
field exists today, so latent — but it fails by omitting a property, which is the direction that
doesn't get noticed.

5. Minor: every field of a @ConfigurationProperties class reports the annotation's line rather
than the field's, so all five ovsx.publishing.* keys point at PublishingConfig.java:24. @Value
entries are line-accurate, so the inconsistency stands out. Fine if deliberate.

Also worth noting

maven-artifact is now a third "must match" pair (buildSrc/build.gradle and this script's //DEPS)
that nothing enforces — formatter-version-check.sh covers only jdt.core and spotless-lib, since
maven-artifact isn't a formatter dependency. Not for this PR, but the check could grow a generic
"these declarations must agree" mode.

Happy to push fixes for 1–4 to this branch if you'd rather not round-trip.