refactor: extract shared resolveVerifiedMavenBinary on JavaMavenProvider

Consolidate duplicate Maven binary resolution logic between ExhortApi
and JavaMavenProvider into a single public static method that verifies
the binary with --version before returning it.

- Add JavaMavenProvider.resolveVerifiedMavenBinary(Path) returning
  Optional<String> with wrapper-first resolution and verification
- Refactor selectMvnRuntime to delegate to the new shared method
- Delete duplicate resolveMavenBinary from ExhortApi, update
  discoverMavenModules to call the shared method via .orElse(null)
- Fix @return JavaDoc on discoverMavenModules to match actual behavior
- Make 2-arg traverseForMvnw static (required by static caller)

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Author: Strum355

src/main/java/io/github/guacsec/trustifyda/impl/ExhortApi.java

@@ -945,18 +945,18 @@ private List<Path> discoverCargoManifests(Path workspaceDir, Set<String> ignoreP
    * Discovers Maven multi-module workspace manifests by invoking {@code mvn help:evaluate} to list
    * declared modules, then recursively checking each module for nested aggregators.
    *
-   * <p>Uses the same Maven binary selection as {@link
-   * io.github.guacsec.trustifyda.providers.JavaMavenProvider}, including wrapper support via {@code
-   * selectMvnRuntime}. Always includes the root {@code pom.xml}. Uses a visited set to prevent
-   * cycles in the module graph.
+   * <p>Uses {@link JavaMavenProvider#resolveVerifiedMavenBinary} for Maven binary resolution,
+   * including wrapper support. Always includes the root {@code pom.xml}. Uses a visited set to
+   * prevent cycles in the module graph.
    *
    * @param workspaceDir the root directory containing the aggregator pom.xml
    * @param ignorePatterns glob patterns for paths to exclude from results
-   * @return list of discovered pom.xml paths, or empty list if Maven is unavailable
+   * @return list of discovered pom.xml paths; always includes the root pom.xml even if Maven is
+   *     unavailable
    */
   private List<Path> discoverMavenModules(Path workspaceDir, Set<String> ignorePatterns) {
     Path rootPom = workspaceDir.resolve("pom.xml");
-    String mvnBin = resolveMavenBinary(workspaceDir);
+    String mvnBin = JavaMavenProvider.resolveVerifiedMavenBinary(workspaceDir).orElse(null);
     if (mvnBin == null) {
       LOG.warning("Maven binary not available; returning root pom.xml only");
       return List.of(rootPom);
@@ -1063,26 +1063,6 @@ static List<String> parseMavenModuleList(String raw) {
         .toList();
   }
 
-  /**
-   * Resolves the Maven binary to use, following the same wrapper preference logic as {@link
-   * io.github.guacsec.trustifyda.providers.JavaMavenProvider#selectMvnRuntime}.
-   *
-   * @param startDir the directory from which to start searching for mvnw
-   * @return the resolved Maven binary path, or null if Maven is not available
-   */
-  private static String resolveMavenBinary(Path startDir) {
-    if (Operations.getWrapperPreference("mvn")) {
-      String wrapperName = Operations.isWindows() ? "mvnw.cmd" : "mvnw";
-      String wrapper =
-          JavaMavenProvider.traverseForMvnw(
-              wrapperName, startDir.resolve("pom.xml").toString(), null);
-      if (wrapper != null) {
-        return wrapper;
-      }
-    }
-    return Operations.getCustomPathOrElse("mvn");
-  }
-
   /**
    * Checks whether a package.json has "private": true, meaning it should not be analyzed as a
    * publishable package.

src/main/java/io/github/guacsec/trustifyda/providers/JavaMavenProvider.java

@@ -39,7 +39,7 @@
 import java.util.List;
 import java.util.Map;
 import java.util.Objects;
-import java.util.logging.Level;
+import java.util.Optional;
 import java.util.logging.Logger;
 import java.util.stream.Collectors;
 import javax.xml.stream.XMLInputFactory;
@@ -431,35 +431,45 @@ private List<String> buildMvnCommandArgs(String... baseArgs) {
   }
 
   private String selectMvnRuntime(final Path manifestPath) {
-    boolean preferWrapper = Operations.getWrapperPreference(MVN);
-    if (preferWrapper && manifestPath != null) {
-      String wrapperName = Operations.isWindows() ? "mvnw.cmd" : "mvnw";
-      String mvnw = traverseForMvnw(wrapperName, manifestPath.toString());
-      if (mvnw != null) {
-        try {
-          // verify maven wrapper is accessible
-          Operations.runProcess(manifestPath.getParent(), mvnw, ARG_VERSION);
-          if (debugLoggingIsNeeded()) {
-            log.info(String.format("using maven wrapper from : %s", mvnw));
-          }
-          return mvnw;
-        } catch (Exception e) {
-          log.log(
-              Level.WARNING,
-              "Failed to check for mvnw due to: {0} Fall back to use mvn",
-              e.getMessage());
+    Path dir = (manifestPath != null) ? manifestPath.getParent() : null;
+    if (dir != null) {
+      Optional<String> resolved = resolveVerifiedMavenBinary(dir);
+      if (resolved.isPresent()) {
+        if (debugLoggingIsNeeded()) {
+          log.info(String.format("using maven binary: %s", resolved.get()));
         }
+        return resolved.get();
       }
     }
-    // If maven wrapper is not requested or not accessible, fall back to use mvn
     String mvn = Operations.getExecutable(MVN, ARG_VERSION);
     if (debugLoggingIsNeeded()) {
       log.info(String.format("using mvn executable from : %s", mvn));
     }
     return mvn;
   }
 
-  private String traverseForMvnw(String wrapperName, String startingManifest) {
+  public static Optional<String> resolveVerifiedMavenBinary(Path workspaceDir) {
+    if (Operations.getWrapperPreference(MVN)) {
+      String wrapperName = Operations.isWindows() ? "mvnw.cmd" : "mvnw";
+      String mvnw = traverseForMvnw(wrapperName, workspaceDir.resolve("pom.xml").toString());
+      if (mvnw != null) {
+        try {
+          Operations.runProcess(workspaceDir, mvnw, ARG_VERSION);
+          return Optional.of(mvnw);
+        } catch (Exception e) {
+          // wrapper found but not functional — fall through to system mvn
+        }
+      }
+    }
+    try {
+      String mvn = Operations.getExecutable(MVN, ARG_VERSION);
+      return Optional.of(mvn);
+    } catch (RuntimeException e) {
+      return Optional.empty();
+    }
+  }
+
+  private static String traverseForMvnw(String wrapperName, String startingManifest) {
     return traverseForMvnw(wrapperName, startingManifest, null);
   }