[ANE-1322] Apply path filters at discovery stage for maven

Previously, Maven POM discovery would traverse and load all POMs during
closure graph building, then apply path filters only during analysis.
This caused issues when excluded POMs were still considered during
discovery, leading to failures even when those paths were filtered out.

This change applies path filters during the POM resolution phase by:
- Adding AllFilters context to buildGlobalClosure and recursiveLoadPom
- Implementing tryRecurse function that checks pathAllowed before
  recursively loading POMs
- Ensuring excluded directories (like .m2) are not traversed during discovery

Fixes issue where users couldn't work around discovery failures by
excluding problematic paths with discovery filters.

🤖 Generated with [Claude Code](https://claude.ai/code)

Co-Authored-By: Claude <noreply@anthropic.com>

Author: ryanlink

src/Strategy/Maven/Pom/Closure.hs

@@ -34,7 +34,7 @@ import Discovery.Filters (AllFilters)
 findProjects :: (Has ReadFS sig m, Has Diagnostics sig m, Has (Reader AllFilters) sig m) => Path Abs Dir -> m [MavenProjectClosure]
 findProjects basedir = do
   pomFiles <- context "Finding pom files" $ findPomFiles basedir
-  globalClosure <- context "Building global closure" $ buildGlobalClosure pomFiles
+  globalClosure <- context "Building global closure" $ buildGlobalClosure basedir pomFiles
   context "Building project closures" $ pure (buildProjectClosures basedir globalClosure)
 
 findPomFiles :: (Has ReadFS sig m, Has Diagnostics sig m, Has (Reader AllFilters) sig m) => Path Abs Dir -> m [Path Abs File]

src/Strategy/Maven/Pom/Resolver.hs

@@ -20,12 +20,14 @@ import Control.Effect.Diagnostics (
   recover,
   (<||>),
  )
-import Control.Monad (unless)
+import Control.Effect.Reader (Reader, ask)
+import Control.Monad (unless, when)
 import Data.Foldable (traverse_)
 import Data.Map.Strict (Map)
 import Data.Map.Strict qualified as Map
 import Data.Maybe (fromMaybe)
 import Data.Text (Text)
+import Discovery.Filters (AllFilters, pathAllowed)
 import Effect.ReadFS (
   ReadFS,
   ReadFSErr (FileReadError),
@@ -35,6 +37,7 @@ import Effect.ReadFS (
   resolveFile,
  )
 import Path (Abs, Dir, File, Path, mkRelFile, parent, (</>))
+import Path.IO qualified as PIO
 import Strategy.Maven.Pom.PomFile (
   MavenCoordinate,
   Pom (pomCoord, pomParentCoord),
@@ -49,9 +52,16 @@ data GlobalClosure = GlobalClosure
   }
   deriving (Eq, Ord, Show)
 
-buildGlobalClosure :: (Has ReadFS sig m, Has Diagnostics sig m) => [Path Abs File] -> m GlobalClosure
-buildGlobalClosure files = do
-  (loadResults, ()) <- runState @LoadResults Map.empty $ traverse_ recursiveLoadPom files
+buildGlobalClosure ::
+  ( Has ReadFS sig m
+  , Has Diagnostics sig m
+  , Has (Reader AllFilters) sig m
+  ) =>
+  Path Abs Dir ->
+  [Path Abs File] ->
+  m GlobalClosure
+buildGlobalClosure rootDir files = do
+  (loadResults, ()) <- runState @LoadResults Map.empty $ traverse_ (recursiveLoadPom rootDir) files
 
   -- TODO: diagnostics/warnings?
   let validated :: Map (Path Abs File) Pom
@@ -85,8 +95,19 @@ indexBy f = Map.fromList . map (\v -> (f v, v))
 type LoadResults = Map (Path Abs File) (Maybe RawPom)
 
 -- Recursively load a pom and its adjacent poms (parent, submodules)
-recursiveLoadPom :: forall sig m. (Has ReadFS sig m, Has (State LoadResults) sig m, Has Diagnostics sig m) => Path Abs File -> m ()
-recursiveLoadPom path = do
+recursiveLoadPom ::
+  forall sig m.
+  ( Has ReadFS sig m
+  , Has (State LoadResults) sig m
+  , Has Diagnostics sig m
+  , Has (Reader AllFilters) sig m
+  ) =>
+  -- | analysis root
+  Path Abs Dir ->
+  -- | pom to load
+  Path Abs File ->
+  m ()
+recursiveLoadPom rootDir path = do
   results <- get @LoadResults
 
   case Map.lookup path results of
@@ -113,7 +134,16 @@ recursiveLoadPom path = do
     recurseRelative :: Text {- relative filepath -} -> m ()
     recurseRelative rel = do
       resolvedPath :: Maybe (Path Abs File) <- recover $ resolvePomPath (parent path) rel
-      traverse_ recursiveLoadPom resolvedPath
+      traverse_ tryRecurse resolvedPath
+
+    -- Decide whether a resolved pom should be loaded based on path filters.
+    tryRecurse :: Path Abs File -> m ()
+    tryRecurse p = do
+      filters <- ask @AllFilters
+      let dirP = parent p
+      case PIO.makeRelative rootDir dirP of
+        Nothing -> pure () -- outside of analysis root, ignore
+        Just relDir -> when (pathAllowed filters relDir) $ recursiveLoadPom rootDir p
 
 -- resolve a Filepath (in Text) that may either point to a directory or an exact
 -- pom file. when it's a directory, we default to pointing at the "pom.xml" in

test/Maven/PathFilterSpec.hs

@@ -0,0 +1,82 @@
+{-# LANGUAGE TemplateHaskell #-}
+
+module Maven.PathFilterSpec (
+  spec,
+) where
+
+import Control.Carrier.Reader (local)
+import Control.Effect.Lift (sendIO)
+import Data.Map.Strict qualified as Map
+import Data.Text qualified as T
+import Data.Text.IO qualified as TIO
+import Discovery.Filters (AllFilters (..), comboExclude)
+import Path (Abs, Dir, File, Path, mkRelDir, mkRelFile, (</>))
+import qualified Path
+import Path.IO (createDirIfMissing)
+import Strategy.Maven.Pom.Resolver (GlobalClosure (..), buildGlobalClosure)
+import Test.Effect (itWithTempDir', shouldBe', EffectStack)
+import Test.Hspec (Spec, describe)
+
+spec :: Spec
+spec =
+  describe "Maven path filtering" $ do
+    itWithTempDir' "does not traverse POMs inside excluded directories" $ \rootDir ->
+      testNoTraversal rootDir
+
+-- | Build a minimal on-disk Maven project with a parent POM located in an
+-- excluded '.m2' directory.  The test asserts that the parent POM is not
+-- loaded when discovery filters exclude that directory.
+
+testNoTraversal :: Path Abs Dir -> EffectStack ()
+testNoTraversal rootDir = do
+  -- Paths -------------------------------------------------------------
+  let rootPomPath :: Path Abs File
+      rootPomPath = rootDir </> $(mkRelFile "pom.xml")
+
+      parentDir :: Path Abs Dir
+      parentDir =
+        rootDir </> $(mkRelDir ".m2/repository/test/parent")
+
+      parentPomPath :: Path Abs File
+      parentPomPath = parentDir </> $(mkRelFile "pom.xml")
+
+  -- File contents -----------------------------------------------------
+  let rootPom :: T.Text
+      rootPom =
+        "<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n" <>
+        "<project xmlns=\"http://maven.apache.org/POM/4.0.0\">\n" <>
+        "  <modelVersion>4.0.0</modelVersion>\n" <>
+        "  <parent>\n" <>
+        "    <groupId>test</groupId>\n" <>
+        "    <artifactId>parent</artifactId>\n" <>
+        "    <version>1.0.0</version>\n" <>
+        "    <relativePath>.m2/repository/test/parent/pom.xml</relativePath>\n" <>
+        "  </parent>\n" <>
+        "  <groupId>test</groupId>\n" <>
+        "  <artifactId>child</artifactId>\n" <>
+        "  <version>1.0.0</version>\n" <>
+        "</project>\n"
+
+      parentPom :: T.Text
+      parentPom =
+        "<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n" <>
+        "<project xmlns=\"http://maven.apache.org/POM/4.0.0\">\n" <>
+        "  <modelVersion>4.0.0</modelVersion>\n" <>
+        "  <groupId>test</groupId>\n" <>
+        "  <artifactId>parent</artifactId>\n" <>
+        "  <version>1.0.0</version>\n" <>
+        "</project>\n"
+
+  -- Create directories + write files ---------------------------------
+  sendIO $ createDirIfMissing True (parentDir)
+  sendIO $ TIO.writeFile (Path.toFilePath rootPomPath) rootPom
+  sendIO $ TIO.writeFile (Path.toFilePath parentPomPath) parentPom
+
+  -- Exclude the .m2 directory via filters -----------------------------
+  let filters = AllFilters mempty (comboExclude [] [$(mkRelDir ".m2")])
+
+  -- Build global closure with filters --------------------------------
+  GlobalClosure{globalPoms} <- local (const filters) $ buildGlobalClosure rootDir [rootPomPath]
+
+  -- We expect only the root POM to be present -------------------------
+  Map.size globalPoms `shouldBe'` 1