From a corporate security perspective, we are being encouraged to implement Static Application Security Testing (SAST). We have projects using both Grails and Spring Boot. It seems that SonarQube and some other tools may have outdated or discontinued Groovy support. I would greatly appreciate any recommendations for effective tools currently in use.

Groovy by default is dynamic, so it makes it harder. There aren't many tools that use static code analysis, the closest one I'm aware of is https://codenarc.org/