fix(workspace): parse actual XML output from mvn help:evaluate

mvn help:evaluate -Dexpression=project.modules returns XML
(<strings><string>...</string></strings>), not the bracket format
([module-a, module-b]) the original parser assumed.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Author: Strum355

src/main/java/io/github/guacsec/trustifyda/impl/ExhortApi.java

@@ -44,6 +44,7 @@
 import jakarta.mail.internet.MimeMultipart;
 import jakarta.mail.util.ByteArrayDataSource;
 import java.io.IOException;
+import java.io.StringReader;
 import java.net.InetSocketAddress;
 import java.net.ProxySelector;
 import java.net.URI;
@@ -75,9 +76,11 @@
 import java.util.logging.Level;
 import java.util.logging.Logger;
 import java.util.stream.Collectors;
+import javax.xml.parsers.DocumentBuilderFactory;
 import org.tomlj.TomlArray;
 import org.tomlj.TomlParseResult;
 import org.tomlj.TomlTable;
+import org.xml.sax.InputSource;
 
 /** Concrete implementation of the Exhort {@link Api} Service. */
 public final class ExhortApi implements Api {
@@ -1198,27 +1201,43 @@ private List<String> listMavenModules(Path dir, String mvnBin) {
   }
 
   /**
-   * Parses the output of {@code mvn help:evaluate -Dexpression=project.modules} which returns a
-   * string like {@code [module-a, module-b]}.
+   * Parses the XML output of {@code mvn help:evaluate -Dexpression=project.modules}. The output
+   * format is {@code <strings><string>module-a</string><string>module-b</string></strings>}.
    *
    * @param raw the raw output string
    * @return list of module name strings
    */
   static List<String> parseMavenModuleList(String raw) {
-    if (raw == null || raw.isEmpty()) {
+    if (raw == null || raw.isEmpty() || "null".equals(raw.trim())) {
       return Collections.emptyList();
     }
-    // Expected format: [module-a, module-b, ...]
-    java.util.regex.Matcher matcher =
-        java.util.regex.Pattern.compile("^\\[(.+)]$").matcher(raw.trim());
-    if (!matcher.matches()) {
+    String trimmed = raw.trim();
+    if (!trimmed.startsWith("<strings")) {
+      return Collections.emptyList();
+    }
+    try {
+      var factory = DocumentBuilderFactory.newInstance();
+      factory.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);
+      factory.setFeature("http://xml.org/sax/features/external-general-entities", false);
+      factory.setFeature("http://xml.org/sax/features/external-parameter-entities", false);
+      factory.setFeature("http://apache.org/xml/features/nonvalidating/load-external-dtd", false);
+      factory.setXIncludeAware(false);
+      factory.setExpandEntityReferences(false);
+      var builder = factory.newDocumentBuilder();
+      var doc = builder.parse(new InputSource(new StringReader(trimmed)));
+      var nodes = doc.getElementsByTagName("string");
+      List<String> modules = new ArrayList<>(nodes.getLength());
+      for (int i = 0; i < nodes.getLength(); i++) {
+        String text = nodes.item(i).getTextContent().trim();
+        if (!text.isEmpty()) {
+          modules.add(text);
+        }
+      }
+      return modules;
+    } catch (Exception e) {
+      LOG.log(Level.WARNING, "Failed to parse Maven module list XML", e);
       return Collections.emptyList();
     }
-    String inner = matcher.group(1);
-    return java.util.Arrays.stream(inner.split(","))
-        .map(String::trim)
-        .filter(s -> !s.isEmpty())
-        .toList();
   }
 
   /**

src/test/java/io/github/guacsec/trustifyda/impl/MavenWorkspaceDiscoveryIT.java

@@ -0,0 +1,115 @@
+/*
+ * Copyright 2023-2025 Trustify Dependency Analytics Authors
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *       http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package io.github.guacsec.trustifyda.impl;
+
+import static org.assertj.core.api.Assertions.assertThat;
+
+import java.io.IOException;
+import java.nio.file.Path;
+import java.util.List;
+import java.util.Set;
+import org.junit.jupiter.api.Assumptions;
+import org.junit.jupiter.api.BeforeAll;
+import org.junit.jupiter.api.Tag;
+import org.junit.jupiter.api.Test;
+
+@Tag("IntegrationTest")
+class MavenWorkspaceDiscoveryIT {
+
+  private static final Path MAVEN_FIXTURES =
+      Path.of("src/test/resources/tst_manifests/workspace/maven");
+
+  @BeforeAll
+  static void requireMaven() {
+    boolean mavenAvailable;
+    try {
+      Process p = new ProcessBuilder("mvn", "-v").redirectErrorStream(true).start();
+      mavenAvailable = p.waitFor() == 0;
+    } catch (Exception e) {
+      mavenAvailable = false;
+    }
+    Assumptions.assumeTrue(mavenAvailable, "mvn not available on PATH");
+  }
+
+  @Test
+  void discoverWorkspaceManifests_mavenMultiModule() throws IOException {
+    Path workspaceDir = MAVEN_FIXTURES.resolve("maven_multi_module").toAbsolutePath().normalize();
+    ExhortApi api = new ExhortApi();
+    List<Path> manifests = api.discoverWorkspaceManifests(workspaceDir, Set.of());
+
+    assertThat(manifests).hasSize(3);
+    assertThat(manifests).allMatch(p -> p.getFileName().toString().equals("pom.xml"));
+    assertThat(manifests.getFirst()).isEqualTo(workspaceDir.resolve("pom.xml"));
+    assertThat(manifests).anyMatch(p -> p.toString().contains("module-a"));
+    assertThat(manifests).anyMatch(p -> p.toString().contains("module-b"));
+  }
+
+  @Test
+  void discoverWorkspaceManifests_nestedAggregator() throws IOException {
+    Path workspaceDir =
+        MAVEN_FIXTURES.resolve("maven_nested_aggregator").toAbsolutePath().normalize();
+    ExhortApi api = new ExhortApi();
+    List<Path> manifests = api.discoverWorkspaceManifests(workspaceDir, Set.of());
+
+    assertThat(manifests).hasSize(3);
+    assertThat(manifests.getFirst()).isEqualTo(workspaceDir.resolve("pom.xml"));
+    assertThat(manifests)
+        .anyMatch(p -> p.toString().contains("parent" + java.io.File.separator + "pom.xml"));
+    assertThat(manifests)
+        .anyMatch(
+            p ->
+                p.toString()
+                    .contains(
+                        "parent"
+                            + java.io.File.separator
+                            + "child"
+                            + java.io.File.separator
+                            + "pom.xml"));
+  }
+
+  @Test
+  void discoverWorkspaceManifests_noModules() throws IOException {
+    Path workspaceDir = MAVEN_FIXTURES.resolve("maven_no_modules").toAbsolutePath().normalize();
+    ExhortApi api = new ExhortApi();
+    List<Path> manifests = api.discoverWorkspaceManifests(workspaceDir, Set.of());
+
+    assertThat(manifests).hasSize(1);
+    assertThat(manifests.getFirst()).isEqualTo(workspaceDir.resolve("pom.xml"));
+  }
+
+  @Test
+  void discoverWorkspaceManifests_missingModuleDirectory() throws IOException {
+    // Maven fails to read the POM when a declared module directory is missing,
+    // so graceful degradation returns only the root pom.xml.
+    Path workspaceDir = MAVEN_FIXTURES.resolve("maven_missing_module").toAbsolutePath().normalize();
+    ExhortApi api = new ExhortApi();
+    List<Path> manifests = api.discoverWorkspaceManifests(workspaceDir, Set.of());
+
+    assertThat(manifests).hasSize(1);
+    assertThat(manifests.getFirst()).isEqualTo(workspaceDir.resolve("pom.xml"));
+  }
+
+  @Test
+  void discoverWorkspaceManifests_ignorePatternFiltering() throws IOException {
+    Path workspaceDir = MAVEN_FIXTURES.resolve("maven_multi_module").toAbsolutePath().normalize();
+    ExhortApi api = new ExhortApi();
+    List<Path> manifests = api.discoverWorkspaceManifests(workspaceDir, Set.of("**/module-b/**"));
+
+    assertThat(manifests).anyMatch(p -> p.toString().contains("module-a"));
+    assertThat(manifests).noneMatch(p -> p.toString().contains("module-b"));
+  }
+}